CVE-2018-25134

published 2025-12-24

CVE-2018-25134: Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative accounts and gain unauthorized control over power supply management.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
synaccess_networks_inc	netbooter_np-02x_np-08x	—	—
synaccess_networks_inc	netbooter_np-02x_np-08x	—	—
synaccess_networks_inc	netbooter_np-02x_np-08x	—	—
synaccess_networks_inc	netbooter_np-02x_np-08x	—	—
synaccess_networks_inc	netbooter_np-02x_np-08x	—	—
synaccess_networks_inc	netbooter_np-02x_np-08x	—	—

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306