CVE-2025-45814 Missing authorization in n/a
Attackers can hijack sessions on NS3000 and NS2000 devices due to missing authentication checks in the query.fcgi endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-45814?
CVE-2025-45814 is a critical missing authorization vulnerability in n/a, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.
Weakness: CWE-306
Which versions are affected by CVE-2025-45814?
It affects 2 products.
Products include Novelsat Ns2000 Firmware, Novelsat Ns3000 Firmware.
How do I fix CVE-2025-45814?
No fix has been published for CVE-2025-45814 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-45814 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-45814 exists.
Sources
Also known as GHSA-wggx-6cm8-mhmw.