CVE-2018-25134 | Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentica… | CVSS 9.8 CRITICAL

Description

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative accounts and gain unauthorized control over power supply management.

Metadata

CVE ID: CVE-2018-25134
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-12-24 14:28 UTC
Published: 2025-12-24 19:27 UTC
Last updated: 2025-12-24 20:26 UTC
Primary CWE: CWE-306
Missing Authentication for Critical Function
Vendor / Product: Synaccess Networks Inc. / netBooter NP-02x/NP-08x
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Synaccess Networks Inc.	netBooter NP-02x/NP-08x	—	6.8C, 6.5C, 6.4BC, 6.4A …

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-45920 https://www.exploit-db.com/exploits/45920
Vendor Product Homepage https://www.synaccess-net.com
Zero Science Lab Disclosure (ZSL-2018-5500) https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5500.php