KYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration

The primary impact of CVE-2019-25254 is the ability for an attacker to create new administrative accounts on a vulnerable KYOCERA Net Admin system. This can be achieved by crafting malicious web pages that automatically submit forms with predefined credentials when a legitimate, logged-in user visits the page. Successful exploitation grants the attacker the same privileges as the newly created administrator, enabling them to modify configurations, access sensitive data, and potentially compromise the entire network. The blast radius extends to any data or systems accessible through the KYOCERA Net Admin interface.

Organizations utilizing KYOCERA Net Admin version 3.4.0906, particularly those with limited network segmentation or weak access controls, are at significant risk. Shared hosting environments where multiple users share the same KYOCERA Net Admin instance are also particularly vulnerable.

1. 2025-12-24Disclosure

   disclosure

1. Reserviert2025-12-24
2. Veröffentlicht2025-12-24
3. Geändert2026-04-07
4. EPSS aktualisiert2026-03-23

Due to the lack of a direct patch for KYOCERA Net Admin 3.4.0906, mitigation strategies focus on reducing the attack surface and preventing exploitation. Implement strict input validation on all administrative forms to prevent malicious data from being submitted. Consider using a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Restrict access to the KYOCERA Net Admin interface to trusted networks and users. Regularly review user accounts and permissions to identify and remove any unauthorized accounts. Since a direct upgrade is unavailable, consider migrating to a newer, supported version of KYOCERA Net Admin if feasible.