CVE-2025-56008
📋 TL;DR
A cross-site scripting (XSS) vulnerability in KeeneticOS allows attackers physically near the router to inject malicious scripts into the 'Wireless ISP' configuration page. This enables them to create new administrative users with full permissions, potentially taking over the device. Only Keenetic routers running vulnerable versions are affected.
💻 Affected Systems
- Keenetic routers with KeeneticOS
📦 What is this software?
Keeneticos by Keenetic
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover by nearby attacker, enabling network traffic interception, malware deployment, and persistent backdoor access.
Likely Case
Unauthorized administrative user creation leading to device compromise and network surveillance.
If Mitigated
Limited impact if proper network segmentation and physical security prevent attacker proximity.
🎯 Exploit Status
Requires attacker to be within wireless range and trick authenticated user into visiting malicious page
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: KeeneticOS 4.3 or later
Vendor Advisory: https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
Restart Required: No
Instructions:
1. Log into router web interface. 2. Navigate to System > Firmware Update. 3. Check for updates and install KeeneticOS 4.3 or newer. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable Wireless ISP feature
allTemporarily disable the vulnerable 'Wireless ISP' configuration page
Restrict web interface access
allLimit web admin interface to wired connections only
🧯 If You Can't Patch
- Physically secure router location to prevent nearby attackers
- Implement network segmentation to isolate router management interface
🔍 How to Verify
Check if Vulnerable:
Check KeeneticOS version in web interface under System > About. If version is below 4.3, device is vulnerable.Check Version:
No CLI command available. Must check via web interface at System > About.Verify Fix Applied:
Confirm KeeneticOS version is 4.3 or higher in System > About page.📡 Detection & Monitoring
Log Indicators:
- Unexpected new user account creation
- Multiple failed login attempts followed by successful admin login
- Unusual configuration changes to Wireless ISP settings
Network Indicators:
- Suspicious JavaScript payloads in HTTP requests to router management interface
- Unexpected admin user logins from new devices
SIEM Query:
source="router_logs" AND (event="user_created" OR event="config_changed") AND user="admin"