Skip to content

Instantly share code, notes, and snippets.

@a2148001284

a2148001284/gist:bcdda75fc8718454f16a7b9259463719 Secret

Created January 6, 2026 07:13
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save a2148001284/bcdda75fc8718454f16a7b9259463719 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save a2148001284/bcdda75fc8718454f16a7b9259463719 to your computer and use it in GitHub Desktop.
Download ZIP
YongJieLi_CVE-2025-65212
Raw
gistfile1.txt
[CVE ID]
CVE-2025-65212
[PRODUCT]
HY511 POE Core < 2.1 && plugins <0.1
[VERSION]
HY511 POE Core < 2.1 && plugins <0.1
[PROBLEM TYPE]
Incorrect Access Control
[DESCRIPTION]
An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1.
The vulnerability stems from the device's insufficient cookie verification,
allowing an attacker to directly request the configuration file address and download the core configuration file
without logging into the device management backend. By reading the corresponding username and self-decrypted MD5 password
in the core configuration file, the attacker can directly log in to the backend, thereby bypassing the front-end backend login page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment