CVE-2018-25150 MEDIUM

CVE-2018-25150: Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration

Vendor Ecessa Corporation
Product Ecessa ShieldLink SL175EHQ
Weakness CWE-352 · CSRF
Published December 24, 2025
Last update March 5, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.

Key dates

02Disclosure timeline

December 24, 2025 CVE published
March 5, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-38763 WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-39600 WordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2026-8411 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete CVE-2025-9887 Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery CVE-2025-23572 WordPress UpDownUpDown plugin <= 1.1 - CSRF to Stored XSS vulnerability