CVE-2025-63206

Published: Nov 19, 2025Modified: Dec 31, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser.

Affected (2)

Products: Dasannetworks: Ds2924 Firmware

Dasannetworks

1 product

Ds2924 Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dasannetworks Ds2924 Firmware	Version 1.01.18
Dasannetworks Ds2924 Firmware	Version 1.02.00

Running on/with	Platform Versions
Dasannetworks Ds2924	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

http://dasansmc.com/

Source: cve@mitre.org

Broken Link

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.