CVE-2025-63219

The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html…

High · published November 19, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

⚡ A single endpoint flaw is all it takes for an attacker to jump into an active session! The ITEL ISO FM SFN Adapter’s /home.html endpoint is now a major security risk! Think of it like a guest who sneaks into a hotel using a forgotten keycard. Once inside, they can access any room and change the settings to suit their needs, jeopardizing security for everyone. An attacker can hijack an active session without any authentication, giving them full control over the device. This means they could modify configurations, install malicious updates, or even cause system failures, leading to absolutely devastating consequences for both functionality and security.

Put simply

Think of it like a guest who sneaks into a hotel using a forgotten keycard. Once inside, they can access any room and change the settings to suit their needs, jeopardizing security for everyone. The vulnerability lies in improper session management on the /home.html endpoint, allowing unauthorized access to active sessions.

What to do

An attacker can hijack an active session without any authentication, giving them full control over the device. This means they could modify configurations, install malicious updates, or even cause system failures, leading to absolutely devastating consequences for both functionality and security. Immediately patch to the latest firmware version that addresses this session management flaw. Review all session management practices to ensure that they adhere to security best practices. Consider implementing stricter access controls on sensitive endpoints. You've got this! With a patch and some vigilance, you can secure your systems and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Published
2025-11-19T00:00Z
EPSS history
Timeline
  • 19 NOV 00:00Z
    The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html…
    cvelistv5