CVE-2025-45814 is a critical vulnerability affecting Novesat NS2000 and NS3000 devices, specifically firmware versions v8.1.1.125110, v7.2.8.124852, and v7.x. It stems from missing authentication checks in the query.fcgi endpoint, enabling attackers to perform session hijacking. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network without user interaction, leading to high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.2.8.124852CPE matchmatch criteria | cpe:2.3:o:novelsat:ns3000_firmware:7.2.8.124852:*:*:*:*:*:*:* | ||
8.1.1.125110CPE matchmatch criteria | cpe:2.3:o:novelsat:ns3000_firmware:8.1.1.125110:*:*:*:*:*:*:* | ||
7.02.08CPE matchmatch criteria | cpe:2.3:o:novelsat:ns2000_firmware:7.02.08:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.