PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-56008 Keenetic CVE debrief

CVE-2025-56008 is a cross-site scripting vulnerability in KeeneticOS before 4.3, affecting the Wireless ISP page. According to the supplied description, an attacker located near the router can abuse the issue to add additional users with full permissions and potentially take over the device. The published CVSS vector indicates network-based attack conditions with required user interaction and a scope change.

Vendor
Keenetic
Product
KeeneticOS
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-10-23
Original CVE updated
2026-05-20
Advisory published
2025-10-23
Advisory updated
2026-05-20

Who should care

Administrators and operators of Keenetic routers running KeeneticOS before 4.3, especially environments that use or expose the Wireless ISP feature, should treat this as relevant.

Technical summary

The NVD metadata maps this issue to CWE-79 (cross-site scripting) and lists the vulnerable KeeneticOS range as versions before 4.3. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which indicates a low-complexity network attack that depends on user interaction and can affect confidentiality and integrity. The supplied description ties the flaw to the Wireless ISP page and to unauthorized creation of full-permission users.

Defensive priority

Medium priority. Patch or upgrade KeeneticOS to 4.3 or later as soon as practical, because the issue can lead to device compromise if abused.

Recommended defensive actions

  • Upgrade KeeneticOS to version 4.3 or later on affected devices.
  • Follow the Keenetic security advisory for the October 2025 web API vulnerabilities.
  • Review router user accounts and remove any unexpected full-permission users.
  • Restrict administrative access to trusted users and minimize unnecessary use of the Wireless ISP page.
  • Check configuration and change history for unauthorized updates after user interaction on the router.
  • If immediate upgrading is not possible, reduce exposure of router management interfaces and monitor for abnormal account creation or configuration changes.

Evidence notes

The supplied NVD metadata states that KeeneticOS versions before 4.3 are vulnerable and classifies the weakness as CWE-79. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The description provided in the source corpus says the issue is an XSS flaw on the Wireless ISP page that can allow a nearby attacker to add users with full permissions and take over the device. The vendor advisory URL is included in the source corpus as the mitigation reference.

Official resources

CVE-2025-56008 was published on 2025-10-23 and later modified on 2026-05-20. For timing context, use the published date as the issue disclosure date and the modified date only as an update marker.