What’s Vulnerable › Vulnerabilities

CVE-2025-56311

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-23 · updated 2026-06-17
• Weakness: CWE-352

Description

In Shenzhen C-Data Technology Co. FD602GW-DX-R410 (firmware v2.2.14), the web management interface contains an authenticated CSRF vulnerability on the reboot endpoint (/boaform/admin/formReboot). An attacker can craft a malicious webpage that, when visited by an authenticated administrator, causes the router to reboot without explicit user consent. This lack of CSRF protection on a sensitive administrative function can lead to denial of service by disrupting network availability.

References

• https://github.com/wrathfulDiety/CVE-2025-56311
• https://github.com/wrathfulDiety/fd602gw-dx-r410-csrf-advisory

Get alerted when CVE-2025-56311 or the next vulnerability affects your stack