CVE-2025-64075
Published: 11 February 2026
Description
A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of session cookie inputs to prevent path traversal exploitation in the check_token function that bypasses authentication.
Mandates timely identification, reporting, and correction of the specific path traversal flaw via firmware patching to eliminate authentication bypass.
Enforces approved authorizations to block unauthorized administrative access even when authentication mechanisms like check_token are targeted.
Security SummaryAI
CVE-2025-64075 is a path traversal vulnerability (CWE-22) in the check_token function of the Shenzhen Zhibotong Electronics ZBT WE2001 router running firmware version 23.09.27. Published on 2026-02-11, it enables remote attackers to bypass authentication mechanisms by supplying a crafted session cookie value, granting unauthorized access to administrative functions. The vulnerability carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low attack complexity, and comprehensive impact on confidentiality, integrity, and availability with changed scope.
Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction or privileges. By crafting and sending a malicious session cookie to the affected device, they can evade the check_token authentication check, effectively impersonating an administrator. Successful exploitation allows full administrative control, potentially enabling actions such as configuration changes, firmware modifications, data exfiltration, or device compromise for further network pivoting.
For mitigation guidance, security practitioners should consult the detailed advisory from NeutSec at https://neutsec.io/advisories/cve-2025-64075 and the vendor's site at https://www.zbtwifi.com, which may provide patches, firmware updates, or workarounds specific to the ZBT WE2001 device.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in check_token function allows remote unauthenticated attackers to bypass authentication via crafted session cookie, directly enabling exploitation of a public-facing application.