The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and compromise system integrity.
References
| Link | Resource |
|---|---|
| https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63219_ITEL%20ISO%20FM%20SFN%20Adapter%20-%20Session%20Hijacking | Exploit Third Party Advisory |
| https://www.itel.it/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 Jan 2026, 16:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:itel:iso-fm:-:*:*:*:*:*:*:* cpe:2.3:o:itel:iso-fm_firmware:2.0.0.0:*:*:*:*:*:*:* |
|
| References | () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63219_ITEL%20ISO%20FM%20SFN%20Adapter%20-%20Session%20Hijacking - Exploit, Third Party Advisory | |
| References | () https://www.itel.it/ - Product | |
| First Time |
Itel iso-fm Firmware
Itel Itel iso-fm |
19 Nov 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
19 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-19 15:15
Updated : 2026-01-12 16:04
NVD link : CVE-2025-63219
Mitre link : CVE-2025-63219
CVE.ORG link : CVE-2025-63219
JSON object : View
Products Affected
itel
- iso-fm
- iso-fm_firmware
CWE
CWE-284
Improper Access Control