CVE-2015-7925

Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.

• CWE-352

• http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01Vendor Advisory
• http://packetstormsecurity.com/files/135069/eWON-XSS-CSRF-Session-Management-RBAC-Issues.html
• http://seclists.org/fulldisclosure/2015/Dec/118
• http://www.securityfocus.com/bid/79625
• https://ics-cert.us-cert.gov/advisories/ICSA-15-351-03Third Party Advisory, US Government Resource
• http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01Vendor Advisory
• http://packetstormsecurity.com/files/135069/eWON-XSS-CSRF-Session-Management-RBAC-Issues.html
• http://seclists.org/fulldisclosure/2015/Dec/118
• http://www.securityfocus.com/bid/79625
• https://ics-cert.us-cert.gov/advisories/ICSA-15-351-03Third Party Advisory, US Government Resource

Published

Dec 23, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7919SearchBlox 8.3 before 8.3.1 allows remote attackers to write…
• CVE-2015-7920Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-7921The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, …9.1
• CVE-2015-7922Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-7923Westermo WeOS before 4.19.0 uses the same SSL private key ac…
• CVE-2015-7924eWON devices with firmware before 10.1s0 do not trigger the …
• CVE-2015-7926eWON devices with firmware before 10.1s0 omit RBAC for I/O s…
• CVE-2015-7927Cross-site scripting (XSS) vulnerability on eWON devices wit…
• CVE-2015-7928eWON devices with firmware before 10.1s0 do not have an off …
• CVE-2015-7929eWON devices with firmware through 10.1s0 support unspecifie…
• CVE-2015-7930Adcon Telemetry A840 Telemetry Gateway Base Station has hard…
• CVE-2015-7931The Java client in Adcon Telemetry A840 Telemetry Gateway Ba…