CVE-2025-63206

9.8 criticalEPSS 0.6%

Critical (9.8) in dasannetworks ds2924 firmware. EPSS 0.6% chance of exploitation in the next 30 days.

An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-11-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dasannetworks:ds2924_firmware

References

http://dasansmc.com/
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass

Check your stack JSON