Cyber Posture

CVE-2018-25134

CriticalPublic PoC

Published: 24 December 2025

Published
24 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative accounts and gain…

more

unauthorized control over power supply management.

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Directly requires limiting and documenting actions permitted without identification or authentication, preventing unauthenticated access to the webNewAcct.cgi script for admin account creation.

AC-3 Access Enforcement good match
prevent

Mandates enforcement of access control policies to ensure critical functions like administrative account creation require proper authentication.

AC-2 Account Management partial match
prevent

Establishes processes and automation for managing account creation, disabling unauthorized admin accounts created via the authentication bypass.

Security SummaryAI

CVE-2018-25134 is an authentication bypass vulnerability in the webNewAcct.cgi script of Synaccess netBooter NP-02x/NP-08x devices running firmware version 6.8. The flaw stems from a missing control check, which allows unauthenticated attackers to create administrative user accounts via crafted POST requests. This issue is classified under CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high confidentiality, integrity, and availability impacts.

Unauthenticated remote attackers can exploit the vulnerability without privileges or user interaction by directly targeting the webNewAcct.cgi endpoint with specially crafted requests. Successful exploitation enables the creation of admin-level accounts, providing unauthorized control over the device's power supply management capabilities, such as remote power cycling or outlet control.

Advisories and resources, including Zero Science's ZSL-2018-5500 report and Exploit-DB entry 45920 (which includes a proof-of-concept), detail the vulnerability and exploitation methods. The vendor site at synaccess-net.com should be consulted for any available patches or firmware updates addressing this issue.

Details

CWE(s)
CWE-306

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
attack.mitre.org →
Why these techniques?

The vulnerability is an authentication bypass in a public-facing web CGI script (T1190: Exploit Public-Facing Application), directly enabling unauthenticated attackers to create local administrative accounts (T1136.001: Create Account - Local Account).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References