CVE-2018-25156

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page with a hidden form to submit password change requests to the device's system configuration interface.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Teradek, LLC	Cube	7.3.6; 7.3.15

References

https://www.exploit-db.com/exploits/44675Exploit
https://www.teradek.comProduct
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5464.phpExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5464.phpExploit, Third Party Advisory

Timeline

Published: Dec 24, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-251576.4Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through cr CVE-2018-251588.8Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through t CVE-2018-251599.8Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenti CVE-2018-251606.5HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other im CVE-2018-251618.2Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting CVE-2018-251626.52-Plan Team 1.0.4 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload executable PHP files by send CVE-2018-251638.2BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali CVE-2018-251647.5EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting CVE-2018-251657.1Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by i CVE-2018-251668.2Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by CVE-2018-251678.2Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthenticated attackers to CVE-2018-251684.3Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrat