CVE-2025-63206

{
  "id": "CVE-2025-63206",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-19T18:15:48.647",
  "lastModified": "2026-11-05T13:10:00.180",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser."
    },
    {
      "lang": "es",
      "value": "Un problema de omisión de autenticación fue descubierto en la interfaz web del Switch Dasan DS2924, versiones de firmware 1.01.18 y 1.02.00, permitiendo a los atacantes obtener privilegios escalados mediante el almacenamiento de cookies manipuladas en el navegador web."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-20T16:07:14.793336Z",
          "id": "CVE-2025-63206",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dasannetworks:ds2924_firmware:1.01.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "44AC6B51-3934-430A-A9D5-95D9BD9874F0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dasannetworks:ds2924_firmware:1.02.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A246406-213F-420A-BB54-82E51FF2B8B5"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:dasannetworks:ds2924:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2335BCDB-543B-4022-9143-40F80F7F4F68"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://dasansmc.com/",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}