KeeneticOS Cross-Site Request Forgery Vulnerability in the Web API

A cross-site request forgery (CSRF) vulnerability has been identified in KeeneticOS versions prior to 4.3, specifically at the '/rci' API endpoint. This vulnerability allows attackers to take control of the device by adding additional users with full permissions. Exploitation requires convincing the victim to open a page containing the exploit.

Impact

Exploitation of this vulnerability could lead to unauthorized user management, allowing attackers to gain full control over the affected device.

Remediation

Users are advised to upgrade to KeeneticOS 4.3, which addresses this vulnerability. Firmware updates can be applied through the device's web interface or the Keenetic mobile app.