AC Smart II - Authentication Bypass

highseverity

0.5%likelihood of exploitation, next 30 days

42%of all CVEs are less likely

Readycheck to confirm it

AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization.

Impact

Attackers can change the administrator password without authorization, leading to full system takeover.

Fix

Update to the latest version that properly verifies login status and user permissions before password reset.

How to confirm it

Send: GET /Doc/WebLogin.asp
Positive when: contains_all(body, "div id=\"div_admin_pwd\" style=\"position:absolute;top:180px;left:50%;width:411px;height:228px;margin:0 0 0 -235px ;z-index:1; visibility: hidden;","AC Smart") and status_code == …

Run it with nuclei: nuclei -id CVE-2025-10204 -u <target>

The full check

id: CVE-2025-10204

info:
  name: AC Smart II - Authentication Bypass
  author: theeldruin
  severity: high
  description: |
    AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization.
  impact: |
    Attackers can change the administrator password without authorization, leading to full system takeover.
  remediation: |
    Update to the latest version that properly verifies login status and user permissions before password reset.
  reference:
    - https://www.notion.so/eldruin/Unauthenticated-Administrator-Password-Reset-AC-Smart-II-v2-1-9-Rev-2251-24d27474cccb80a68e47f907b94abed9
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10204
  classification:
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Doc/WebLogin.asp"
    fofa-query: body="Doc/WebLogin.asp"
  tags: cve,cve2025,unauth,auth-bypass,vkev,vuln

http:
  - raw:
      - |
        GET /Doc/WebLogin.asp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "div id=\"div_admin_pwd\" style=\"position:absolute;top:180px;left:50%;width:411px;height:228px;margin:0 0 0 -235px ;z-index:1; visibility: hidden;","AC Smart")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from