CVE-2025-53757

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-53757", "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c", "state": "PUBLISHED", "assignerShortName": "CERT-In", "dateReserved": "2025-07-09T11:17:31.820Z", "datePublished": "2025-07-16T11:25:05.468Z", "dateUpdated": "2025-07-16T18:50:46.637Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "XPON ONU Wi-Fi Router (DG-GR6821AC)", "vendor": "Digisol", "versions": [{"status": "affected", "version": "V3.2.XX"}]}], "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability is reported by Shravan Singh from Kavach IoT Security."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP connection. <br><br>Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information from the targeted device.<br>"}], "value": "This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP connection. \n\nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information from the targeted device."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-614", "description": "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1004", "description": "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "66834db9-ab24-42b4-be80-296b2e40335c", "shortName": "CERT-In", "dateUpdated": "2025-07-16T11:25:05.468Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0147"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade Digisol DG-GR6821AC Router firmware to version HG323DACv5_all_V3.2.02-250509_Digisolver<br>"}], "value": "Upgrade Digisol DG-GR6821AC Router firmware to version HG323DACv5_all_V3.2.02-250509_Digisolver"}], "source": {"discovery": "UNKNOWN"}, "title": "Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-16T18:50:32.424674Z", "id": "CVE-2025-53757", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T18:50:46.637Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-53757", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-16T18:50:32.424674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T18:50:38.244Z"}}], "cna": {"title": "Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability is reported by Shravan Singh from Kavach IoT Security."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Digisol", "product": "XPON ONU Wi-Fi Router (DG-GR6821AC)", "versions": [{"status": "affected", "version": "V3.2.XX"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade Digisol DG-GR6821AC Router firmware to version HG323DACv5_all_V3.2.02-250509_Digisolver", "supportingMedia": [{"type": "text/html", "value": "Upgrade Digisol DG-GR6821AC Router firmware to version HG323DACv5_all_V3.2.02-250509_Digisolver<br>", "base64": false}]}], "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0147", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP connection. \n\nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information from the targeted device.", "supportingMedia": [{"type": "text/html", "value": "This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP connection. <br><br>Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information from the targeted device.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-614", "description": "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1004", "description": "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"}]}], "providerMetadata": {"orgId": "66834db9-ab24-42b4-be80-296b2e40335c", "shortName": "CERT-In", "dateUpdated": "2025-07-16T11:25:05.468Z"}}}, "cveMetadata": {"cveId": "CVE-2025-53757", "state": "PUBLISHED", "dateUpdated": "2025-07-16T18:50:46.637Z", "dateReserved": "2025-07-09T11:17:31.820Z", "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c", "datePublished": "2025-07-16T11:25:05.468Z", "assignerShortName": "CERT-In"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "XPON ONU Wi-Fi Router (DG-GR6821AC)", "vendor": "Digisol", "versions": [{"status": "affected", "version": "V3.2.XX"}]}], "source": "vdisclose@cert-in.org.in"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router web interface. A remote attacker could exploit this vulnerability by capturing the session cookies transmitted over an unsecure HTTP connection. \n\nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information from the targeted device."}, {"lang": "es", "value": "Esta vulnerabilidad existe en el enrutador Digisol DG-GR6821AC debido a una configuraci\u00f3n incorrecta de los indicadores Secure y HttpOnly en las cookies de sesi\u00f3n asociadas a la interfaz web del enrutador. Un atacante remoto podr\u00eda explotar esta vulnerabilidad capturando las cookies de sesi\u00f3n transmitidas a trav\u00e9s de una conexi\u00f3n HTTP no segura. Si se explota con \u00e9xito esta vulnerabilidad, el atacante podr\u00eda obtener informaci\u00f3n confidencial del dispositivo objetivo."}], "id": "CVE-2025-53757", "lastModified": "2026-06-17T09:38:50.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vdisclose@cert-in.org.in", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53757", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-16T18:50:32.424674Z", "version": "2.0.3"}}]}, "published": "2025-07-16T12:15:30.363", "references": [{"source": "vdisclose@cert-in.org.in", "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0147"}], "sourceIdentifier": "vdisclose@cert-in.org.in", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-614"}, {"lang": "en", "value": "CWE-1004"}], "source": "vdisclose@cert-in.org.in", "type": "Secondary"}]}

{}

{}