CVE-2018-25134
Published: 24 December 2025
Summary
CVE-2018-25134 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Zeroscience (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2018-25134 is an authentication bypass vulnerability in the webNewAcct.cgi script of Synaccess netBooter NP-02x/NP-08x devices running firmware version 6.8. The flaw stems from a missing control check, which allows unauthenticated attackers to create administrative user accounts via crafted POST requests. This issue is classified under CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high confidentiality, integrity, and availability impacts.
Unauthenticated remote attackers can exploit the vulnerability without privileges or user interaction by directly targeting the webNewAcct.cgi endpoint with specially crafted requests. Successful exploitation enables the creation of admin-level accounts, providing unauthorized control over the device's power supply management capabilities, such as remote power cycling or outlet control.
Advisories and resources, including Zero Science's ZSL-2018-5500 report and Exploit-DB entry 45920 (which includes a proof-of-concept), detail the vulnerability and exploitation methods. The vendor site at synaccess-net.com should be consulted for any available patches or firmware updates addressing this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205344
Vulnerability details
Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative accounts and gain…
more
unauthorized control over power supply management.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing web CGI script (T1190: Exploit Public-Facing Application), directly enabling unauthenticated attackers to create local administrative accounts (T1136.001: Create Account - Local Account).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires limiting and documenting actions permitted without identification or authentication, preventing unauthenticated access to the webNewAcct.cgi script for admin account creation.
Mandates enforcement of access control policies to ensure critical functions like administrative account creation require proper authentication.
Establishes processes and automation for managing account creation, disabling unauthorized admin accounts created via the authentication bypass.