First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2015-7925

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Dec 23, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-79269.9eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain s CVE-2015-79276.1Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script CVE-2015-79288.5eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote at CVE-2015-79294.3eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive informati CVE-2015-793010.0Adcon Telemetry A840 Telemetry Gateway Base Station has hardcoded credentials, which allows remote attackers to obtain administrative access CVE-2015-79318.7The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-mid CVE-2015-79328.6Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network.CVE-2015-79348.6The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecifie CVE-2015-79357.5Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.CVE-2015-79367.5Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication CVE-2015-793710.0Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attacker CVE-2015-79389.8Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.

CVE-2015-7925: High severity, CVSS 8.0 | Vulnix