CVE-2025-65212 | An issue was discovered in NJHYST HY511 POE core before 2.1 … | CVSS 9.8 CRITICAL

Description

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the device management backend. By reading the corresponding username and self-decrypted MD5 password in the core configuration file, the attacker can directly log in to the backend, thereby bypassing the front-end backend login page.

Metadata

CVE ID: CVE-2025-65212
State: PUBLISHED
Assigner: mitre
Reserved: 2025-11-18 00:00 UTC
Published: 2026-01-06 00:00 UTC
Last updated: 2026-01-06 16:39 UTC
Primary CWE: CWE-565
CWE-565 Reliance on Cookies without Validation and Integrity…
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-565	adp	CWE-565 Reliance on Cookies without Validation and Integrity Checking

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)