CVE-2025-63226
📋 TL;DR
This vulnerability allows attackers on the same network as a logged-in user to hijack their session and add unauthorized administrative accounts to the Sencore SMP100 Media Platform. Attackers can then gain full system access and perform malicious activities. Only users of Sencore SMP100 with vulnerable firmware versions are affected.
💻 Affected Systems
- Sencore SMP100 SMP Media Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over the media platform, allowing them to disrupt operations, steal sensitive media content, or use the device as a pivot point into the network.
Likely Case
Attackers create backdoor administrative accounts to maintain persistent access, potentially leading to data theft or service disruption.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated media platform segment.
🎯 Exploit Status
Exploit requires network access and victim's active session
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sencore.com/
Restart Required: No
Instructions:
Check vendor website for security updates and patch notes
🔧 Temporary Workarounds
Network Segmentation
allIsolate SMP100 devices on dedicated VLAN with strict access controls
Session Timeout Reduction
allConfigure shorter session timeout periods if supported
🧯 If You Can't Patch
- Segment SMP100 devices on isolated network segments with firewall rules restricting access to authorized IPs only
- Implement strict access controls and monitor for unauthorized user creation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface and compare against vulnerable versionsCheck Version:
Access web interface and navigate to system information pageVerify Fix Applied:
Verify firmware version is updated beyond vulnerable versions and test session hijacking attempts📡 Detection & Monitoring
Log Indicators:
- Unauthorized user creation events
- Multiple failed login attempts followed by successful user creation
Network Indicators:
- Unusual HTTP POST requests to /UserManagement.html from unexpected IPs
SIEM Query:
source="smp100" AND (event="user_created" OR url="/UserManagement.html")