CVE-2018-25156— Teradek Cube 7.3.6 Cross-Site Request Forgery Password Change
Quick assessment
Affected
Teradek, LLC Cube
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Teradek Cube是Teradek公司的视频解码器。 Teradek Cube 7.3.6版本存在安全漏洞，该漏洞源于容易受到跨站请求伪造攻击，可能导致更改管理员密码。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-25156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Teradek Cube 7.3.6 Cross-Site Request Forgery Password Change
Source: CVE Program / CVE List V5
Vulnerability Description
Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page with a hidden form to submit password change requests to the device's system configuration interface.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Teradek Cube 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Teradek Cube是Teradek公司的视频解码器。 Teradek Cube 7.3.6版本存在安全漏洞，该漏洞源于容易受到跨站请求伪造攻击，可能导致更改管理员密码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Teradek, LLC | Cube | 7.3.6 | - |
|
II. Public POCs for CVE-2018-25156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25156
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2018-25156 (2)
-
🔗 Zero Science Lab » Teradek Cube 7.3.6 CSRF Change Password Exploit Read full article third-party-advisory
Same Patch Batch · Teradek, LLC · 2025-12-24 · 3 CVEs total
| CVE-2019-25251 | 6.5 MEDIUM | Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings |
| CVE-2018-25155 | 4.3 MEDIUM | Teradek Slice 7.3.15 Cross-Site Request Forgery via Password Change |
IV. Related Vulnerabilities
Same product: Cube
-
CVE-2026-50005
Brickcom Cameras Use of Default Credentials -
CVE-2026-50245
Brickcom Cameras Missing Authentication for Critical Functio -
CVE-2026-25958
Cube privilege escalation via a specially crafted request -
CVE-2026-25957
Cube Denial of Service (DoS) - An authenticated attacker can -
CVE-2023-50709
Denial of service attack on the cube-api endpoint
Same weakness: CWE-352
-
CVE-2026-107809
Nginx-UI AuthRequired token cookie fallback enables CSRF aga -
CVE-2026-62026
WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Reque -
CVE-2026-96671
WordPress Featured Image from URL plugin <= 6.0.7 - Cross Si -
CVE-2026-107831
Jivejdon through 5.0 CSRF via GET-based Account and Thread A -
CVE-2026-78388
Security vulnerabilities have been found in IBM Verify Ident
V. Comments for CVE-2018-25156
No comments yet