CVE-2025-65212
BaseFortify
Publication date: 2026-01-06
Last updated on: 2026-01-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| njhyst | hy511_poe_core | to 2.1 (exc) |
| njhyst | hy511_poe_plugins | to 0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-565 | The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update NJHYST HY511 POE Core to version 2.1 or later and update all plugins to version 0.1 or later. These updates address the insufficient cookie verification issue that allows unauthorized access to the core configuration file. Additionally, restrict access to the device management backend and monitor for any unauthorized requests attempting to download configuration files. [2]
Can you explain this vulnerability to me?
This vulnerability exists in NJHYST HY511 POE core before version 2.1 and its plugins before 0.1. It is caused by insufficient cookie verification, which allows an attacker to directly request and download the device's core configuration file without logging into the management backend. This configuration file contains the username and a self-decrypted MD5 hashed password. With these credentials, the attacker can bypass the frontend login page and gain unauthorized access to the backend management interface. [2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the device's backend management interface. An attacker who exploits this flaw can obtain sensitive credentials and bypass authentication, potentially allowing them to control or manipulate the device, access sensitive information, or disrupt normal operations. [2]