CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit.
References
| Link | Resource |
|---|---|
| https://keenetic.com/ | Product |
| https://keenetic.com/global/security#october-2025-web-api-vulnerabilities | Vendor Advisory |
Configurations
History
04 Nov 2025, 13:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://keenetic.com/ - Product | |
| References | () https://keenetic.com/global/security#october-2025-web-api-vulnerabilities - Vendor Advisory | |
| First Time |
Keenetic keeneticos
Keenetic |
|
| CPE | cpe:2.3:o:keenetic:keeneticos:*:*:*:*:*:*:*:* |
23 Oct 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-93 |
23 Oct 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-23 15:15
Updated : 2025-11-04 13:10
NVD link : CVE-2025-56007
Mitre link : CVE-2025-56007
CVE.ORG link : CVE-2025-56007
JSON object : View
Products Affected
keenetic
- keeneticos
CWE
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')