Description
Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.
Published: 2025-12-24
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:ecessa:shieldlink_sl175ehq_firmware:10.7.4:*:*:*:*:*:*:*

Mon, 29 Dec 2025 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Ecessa
Ecessa shieldlink Sl175ehq
Ecessa shieldlink Sl175ehq Firmware
Vendors & Products Ecessa
Ecessa shieldlink Sl175ehq
Ecessa shieldlink Sl175ehq Firmware

Thu, 25 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Dec 2025 19:45:00 +0000

Type Values Removed Values Added
Description Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.
Title Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ecessa Shieldlink Sl175ehq Shieldlink Sl175ehq Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-05T12:02:14.314Z

Reserved: 2025-12-24T14:28:02.436Z

Link: CVE-2018-25150

cve-icon Vulnrichment

Updated: 2025-12-24T20:10:51.261Z

cve-icon NVD

Status : Deferred

Published: 2025-12-24T20:15:49.663

Modified: 2026-04-15T00:35:42.020

Link: CVE-2018-25150

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-29T23:04:28Z

Weaknesses