CVE-2025-10204
Published: 14 September 2025
Summary
CVE-2025-10204 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Lge (inferred from references). Its CVSS base score is 7.1 (High).
Operationally, ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-10204 affects AC Smart II and stems from missing authentication for a critical function, specifically a hidden administrative password reset form that can be revealed and submitted without any login verification or permission checks. The flaw is tracked under CWE-306 and carries a CVSS 4.0 score of 7.1.
An attacker with adjacent-network access can open the affected page in a browser, use developer tools to expose the concealed form, and directly change the administrator password, thereby gaining full control over the device without prior credentials.
LG has published security bulletins at https://lgsecurity.lge.com/bulletins that address the issue and outline available mitigations or patches for affected AC Smart II installations.
EPSS for the vulnerability rose from a low baseline to a peak of 0.0567 on 2026-02-03 before receding to the current value of 0.0245, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29122
Vulnerability details
A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use…
more
the form. This form allows you to change the administrator password without verifying login status or user permissions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.