What’s Vulnerable › Vulnerabilities
CVE-2018-25151: Ecessa WANWorx WVR-30 < 10.7.4 Cross-Site Request Forgery via User Configuration
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-24 · updated 2026-06-17
- Weakness: CWE-352
Description
Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an authenticated administrator into loading the page.
Affected products
- Ecessa Corporation WANWorx WVR-30: before 10.7.4; 10.7.4, 10.6.9, 10.6.5.2, 10.5.4, 10.2.24, 9.2.24
References
Get alerted when CVE-2018-25151 or the next vulnerability affects your stack