Executive brief
A security vulnerability exists in Keenetic network routers that could allow an attacker to take full control of the device. By tricking a logged-in administrator into visiting a malicious website, the attacker can silently create new administrative accounts with full permissions. This could lead to unauthorized access to the home or business network, data interception, or complete service disruption.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the '/rci' API endpoint of KeeneticOS before version 4.3. The endpoint lacks sufficient CSRF protections and fails to validate the 'Content-Type' header, allowing attackers to bypass standard browser restrictions. An attacker can craft a malicious webpage that, when visited by an authenticated administrator, sends a hidden POST request to the router's API. This request can be used to create a new user with 'cli' and 'http' tags (full administrative rights). The exploit utilizes a 'text/plain' encoding trick to maintain a valid JSON structure in the request body, facilitating the unauthorized configuration change.
Affected products
- Keenetic KeeneticOS before 4.3
Timeline
- 2025-10-23: advisory: Vendor advisory and CVE published
- 2025-10-23: disclosed