CVE-2015-7925

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 23, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-79269.9eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sCVE-2015-79276.1Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web scriptCVE-2015-79288.5eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote atCVE-2015-79294.3eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive informatiCVE-2015-793010.0Adcon Telemetry A840 Telemetry Gateway Base Station has hardcoded credentials, which allows remote attackers to obtain administrative accessCVE-2015-79318.7The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-midCVE-2015-79328.6Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network.CVE-2015-79348.6The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecifieCVE-2015-79357.5Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.CVE-2015-79367.5Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authenticationCVE-2015-793710.0Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackerCVE-2015-79389.8Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
CVE-2015-7925: High severity, CVSS 8.0 | Vulnix