CVE-2025-56008

{
  "id": "CVE-2025-56008",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-23T15:15:39.213",
  "lastModified": "2026-11-05T21:10:00.183",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at \"Wireless ISP\" page allows attackers located near to the router to takeover the device via adding additional users with full permissions."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cross-site scripting (XSS) en KeeneticOS anterior a la versión 4.3 en la página ’Wireless ISP’ permite a atacantes ubicados cerca del router tomar el control del dispositivo mediante la adición de usuarios adicionales con permisos completos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-23T16:31:00.525936Z",
          "id": "CVE-2025-56008",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:keenetic:keeneticos:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.3",
              "matchCriteriaId": "31463ACE-A8BB-4E5D-AA71-1BC479DE8AA4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/notdenied/writeups/blob/main/CVE/CVE-2025-56008.md",
      "source": "[email protected]"
    },
    {
      "url": "https://keenetic.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://keenetic.com/global/security#october-2025-web-api-vulnerabilities",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}