Cross-Site Request Forgery in Ecessa Edge EV150 by Ecessa Corporation
CVE-2018-25152

5.1MEDIUM

Key Information:

Vendor

Ecessa Corporation

Status
Ecessa Edge Ev150
Vendor
CVE Published:
24 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25152?

The Ecessa Edge EV150 version 10.7.4 suffers from a cross-site request forgery vulnerability. This flaw enables attackers to generate unauthorized administrative user accounts without proper authentication. By designing a malicious webpage, an attacker can submit crafted requests to the vulnerable endpoint, /cgi-bin/pl_web.cgi/util_configlogin_act, allowing for the creation of superuser accounts with any specified credentials. This vulnerability poses a significant risk, as it could lead to unauthorized access and control over the affected systems.

Affected Version(s)

Ecessa Edge EV150 10.7.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25152 - Proof of Concept

References

https://www.exploit-db.com/exploits/44932
exploit
https://www.ecessa.com
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2018-25152 : Cross-Site Request Forgery in Ecessa Edge EV150 by Ecessa Corporation