CVE-2025-36754
CriticalSummary
The authentication mechanism on the web interface is not properly implemented. It is possible to bypass authentication checks by crafting a POST request with new settings since there is no session token or authentication in place. This would allow an attacker to point the device to an arbitrary address for domain name resolution, e.g., to facilitate a man-in-the-middle (MitM) attack.
Risk Assessment
An attacker can take control of the device configuration, potentially leading to interception of network traffic or redirection to malicious servers.
Recommendation
Implement proper authentication and session mechanisms in the web interface. Restrict access to the interface to trusted networks only.
Original NVD description (English source)
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an arbitrary address for domain name resolution to e.g. facililitate a man-in-the-middle (MitM) attack.