CVE-2025-67013

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-26 · updated 2026-10-13
Weakness: CWE-352

Description

The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.

Affected products

Etlsystems C0401D1Uia-22476 Firmware: 1.8
Etlsystems C0401D1Ula-22419 Firmware: 1.8
Etlsystems C0401D1Ula-22456 Firmware: 1.8
Etlsystems C0401S1Ula-22418 Firmware: 1.8
Etlsystems C0401S1Ula-22455 Firmware: 1.8
Etlsystems C0801D1Ula-22421 Firmware: 1.8
Etlsystems C0801D1Ula-22458 Firmware: 1.8
Etlsystems C0801S1Ula-22420 Firmware: 1.8
Etlsystems C0801S1Ula-22457 Firmware: 1.8
Etlsystems C1601S1Uia-22479 Firmware: 1.8
Etlsystems C1601S1Ula-22422 Firmware: 1.8
Etlsystems C1601S1Ula-22459 Firmware: 1.8
Etlsystems D0104D1Ula-22411 Firmware: 1.8
Etlsystems D0104D1Ula-22451 Firmware: 1.8
Etlsystems D0104S1Ula-22410 Firmware: 1.8
Etlsystems D0104S1Ula-22450 Firmware: 1.8
Etlsystems D0108D1Uia-22473 Firmware: 1.8
Etlsystems D0108D1Ula-22413 Firmware: 1.8
Etlsystems D0108D1Ula-22453 Firmware: 1.8
Etlsystems D0108S1Ula-22412 Firmware: 1.8
Etlsystems D0108S1Ula-22452 Firmware: 1.8
Etlsystems D0116S1Uia-22474 Firmware: 1.8
Etlsystems D0116S1Ula-22414 Firmware: 1.8
Etlsystems D0116S1Ula-22454 Firmware: 1.8
Etlsystems H0104D1Ula-22460 Firmware: 1.8
Etlsystems H0108D1Ula-22431 Firmware: 1.8
Etlsystems H0108D1Ula-22461 Firmware: 1.8

References

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF
https://www.etlsystems.com/

Get alerted when CVE-2025-67013 or the next vulnerability affects your stack