CVE-2019-25254

EUVD-2025-205300
KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft malicious web pages that automatically submit forms to add new admin accounts with predefined credentials when a logged-in user visits the page.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
Affected Products (NVD)
VendorProductVersion
kyoceranet_admin
3.4.0906
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://global.kyocera.com
https://www.exploit-db.com/exploits/44431
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5458.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5458.php