CVE-2025-63666

n/a / n/a PUBLISHED

Description (CNA)

Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://github.com/Remenis/CVE-2025-63666

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.