Ecessa WANWorx WVR-30 up to 10.7.4 cross-site request forgery

Summaryinfo

A vulnerability was found in Ecessa WANWorx WVR-30 up to 10.7.4 and classified as problematic. This affects an unknown part. Such manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2018-25151. The attack may be launched remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Ecessa WANWorx WVR-30 up to 10.7.4. Affected by this issue is an unknown code. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. CVE summarizes:

Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an authenticated administrator into loading the page.

The weakness was shared by Gjoko Krstic as 44936. The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2018-25151 since 12/24/2025. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 10.7.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (44936) and EUVD (EUVD-2025-205339). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Ecessa

Name

• WANWorx WVR-30

Version

• 9.2.0
• 9.2.1
• 9.2.2
• 9.2.3
• 9.2.4
• 9.2.5
• 9.2.6
• 9.2.7
• 9.2.8
• 9.2.9
• 9.2.10
• 9.2.11
• 9.2.12
• 9.2.13
• 9.2.14
• 9.2.15
• 9.2.16
• 9.2.17
• 9.2.18
• 9.2.19
• 9.2.20
• 9.2.21
• 9.2.22
• 9.2.23
• 9.2.24
• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4
• 10.2.5
• 10.2.6
• 10.2.7
• 10.2.8
• 10.2.9
• 10.2.10
• 10.2.11
• 10.2.12
• 10.2.13
• 10.2.14
• 10.2.15
• 10.2.16
• 10.2.17
• 10.2.18
• 10.2.19
• 10.2.20
• 10.2.21
• 10.2.22
• 10.2.23
• 10.2.24
• 10.5.0
• 10.5.1
• 10.5.2
• 10.5.3
• 10.5.4
• 10.6.0
• 10.6.1
• 10.6.2
• 10.6.3
• 10.6.4
• 10.6.5
• 10.6.5.0
• 10.6.5.1
• 10.6.5.2
• 10.6.6
• 10.6.7
• 10.6.8
• 10.6.9
• 10.7.0
• 10.7.1
• 10.7.2
• 10.7.3
• 10.7.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion