DAEnetIP4 METO v1.25 - Session Hijacking

highseverity

8.1CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

DAEnetIP4 METO v1.25 contains improper session management in the /login_ok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens.

Impact

Attackers can hijack user sessions, gaining unauthorized access to user accounts and sensitive information.

Fix

Implement proper session management and secure session tokens, and update to the latest version if available.

How to confirm it

Send: GET {{BaseURL}}/login_ok.htm
Positive when: status_code == 200 and contains_all(body, "DAEnetIP4", "session=")

Run it with nuclei: nuclei -id CVE-2025-28242 -u <target>

The full check

id: CVE-2025-28242

info:
  name: DAEnetIP4 METO v1.25 - Session Hijacking
  author: 0x_Akoko
  severity: high
  description: |
    DAEnetIP4 METO v1.25 contains improper session management in the /login_ok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens.
  impact: |
    Attackers can hijack user sessions, gaining unauthorized access to user accounts and sensitive information.
  remediation: |
    Implement proper session management and secure session tokens, and update to the latest version if available.
  reference:
    - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28242
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28242
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cwe-id: CWE-384
  metadata:
    max-request: 1
    verified: true
    vendor: denkovi
    product: daenetip4_meto
    shodan-query: title:"DAEnetIP4"
    fofa-query: title="DAEnetIP4"
  tags: cve,cve2025,daenetip4,denkovi,session-hijacking,iot,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login_ok.htm"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "DAEnetIP4", "session=")'
        condition: and

    extractors:
      - type: regex
        name: session-token
        part: body
        group: 1
        regex:
          - 'session=([0-9]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from