CVE-2025-62772 Details

A vulnerability exists in Mercku M6a devices running through version 2.1.0, where session tokens can remain valid for extended periods, in some cases, months. The authentication system generates predictable session tokens based on timestamps, allowing for brute-force attacks to hijack administrative sessions. This issue is compounded by a lack of rate limiting and secure cryptographic algorithms for session generation. Once administrative access is gained, a hidden telnet backdoor can be activated, leading to root privilege escalation and full control over the device.

Users are advised to implement proper CSRF protection, remove or secure hidden endpoints, use cryptographically secure session generation, enforce session expiration, and follow GPL requirements for OpenWrt modifications.