Executive brief
A security vulnerability exists in KeeneticOS, the operating system used by Keenetic network routers. An attacker can trick a logged-in administrator into visiting a malicious webpage, which then uses a technical flaw to inject commands into the router's management interface. This could allow the attacker to create new administrative accounts, effectively taking full control of the device and the network it manages.
Technical details
A CRLF (Carriage Return Line Feed) injection vulnerability exists in the 'url' parameter of the '/auth' API endpoint in KeeneticOS versions prior to 4.3. The application fails to properly neutralize control characters, allowing an attacker to inject arbitrary HTTP headers and response body content. By crafting a URL that starts with a newline character (%0a), an attacker can bypass the intended redirection, set a 'Content-Type: text/html' header, and deliver a malicious JavaScript payload (XSS). This can be leveraged to perform administrative actions, such as adding new users with full permissions, provided a victim with an active session is induced to click the link. The vulnerability has been patched in KeeneticOS 4.3.
Affected products
- Keenetic KeeneticOS before 4.3
Timeline
- 2025-10-23: disclosed
- 2025-10-23: advisory
- 2025-10-23: patched: Fixed in KeeneticOS 4.3