CVE-2025-65128 Details

A vulnerability exists in the web management API of the Shenzhen Zhibotong Electronics ZBT WE2001 router, specifically in version 23.09.27. The issue arises from a missing authentication mechanism, allowing unauthenticated attackers on the local network to alter router and network settings. Exploitation involves invoking specific operations that end with '*_nocommit' and providing the required parameters, enabling attackers to change various configuration details such as the SSID, Wi-Fi passwords, and administrative credentials, all without the need for authentication or an active session.