{"id":"CVE-2025-67013","title":"The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical conf…","summary":"The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical conf…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-352"],"vendor":"etlsystems","product":"d0116s1ula-22454_firmware","affected":["d0116s1ula-22454_firmware = 1.8","d0116s1uia-22474_firmware = 1.8","c0401s1ula-22418_firmware = 1.8","c0801s1ula-22420_firmware = 1.8","c1601s1ula-22422_firmware = 1.8","c0401s1ula-22455_firmware = 1.8","c0801s1ula-22457_firmware = 1.8","c1601s1ula-22459_firmware = 1.8","c1601s1uia-22479_firmware = 1.8","d0104d1ula-22411_firmware = 1.8","d0108d1ula-22413_firmware = 1.8","d0104d1ula-22451_firmware = 1.8","d0108d1ula-22453_firmware = 1.8","d0108d1uia-22473_firmware = 1.8","c0401d1ula-22419_firmware = 1.8","c0801d1ula-22421_firmware = 1.8","c0401d1ula-22456_firmware = 1.8","c0801d1ula-22458_firmware = 1.8","c0401d1uia-22476_firmware = 1.8","h0108d1ula-22431_firmware = 1.8","h0104d1ula-22460_firmware = 1.8","h0108d1ula-22461_firmware = 1.8","d0104s1ula-22410_firmware = 1.8","d0108s1ula-22412_firmware = 1.8","d0116s1ula-22414_firmware = 1.8","d0104s1ula-22450_firmware = 1.8","d0108s1ula-22452_firmware = 1.8"],"published":"2025-12-26","updated":"2026-10-13","sourceUpdated":"2026-10-13T09:10:00.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67013","references":[{"url":"https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF","label":"cve@mitre.org"},{"url":"https://www.etlsystems.com/","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00168,"epssPercentile":0.05556,"ingestedAt":"2026-10-13T09:20:23.156Z","slug":"CVE-2025-67013","body":"## Overview\n\nThe web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.\n\n## Affected\n\n- `d0116s1ula-22454_firmware = 1.8`\n- `d0116s1uia-22474_firmware = 1.8`\n- `c0401s1ula-22418_firmware = 1.8`\n- `c0801s1ula-22420_firmware = 1.8`\n- `c1601s1ula-22422_firmware = 1.8`\n- `c0401s1ula-22455_firmware = 1.8`\n- `c0801s1ula-22457_firmware = 1.8`\n- `c1601s1ula-22459_firmware = 1.8`\n- `c1601s1uia-22479_firmware = 1.8`\n- `d0104d1ula-22411_firmware = 1.8`\n- `d0108d1ula-22413_firmware = 1.8`\n- `d0104d1ula-22451_firmware = 1.8`\n- `d0108d1ula-22453_firmware = 1.8`\n- `d0108d1uia-22473_firmware = 1.8`\n- `c0401d1ula-22419_firmware = 1.8`\n- `c0801d1ula-22421_firmware = 1.8`\n- `c0401d1ula-22456_firmware = 1.8`\n- `c0801d1ula-22458_firmware = 1.8`\n- `c0401d1uia-22476_firmware = 1.8`\n- `h0108d1ula-22431_firmware = 1.8`\n- `h0104d1ula-22460_firmware = 1.8`\n- `h0108d1ula-22461_firmware = 1.8`\n- `d0104s1ula-22410_firmware = 1.8`\n- `d0108s1ula-22412_firmware = 1.8`\n- `d0116s1ula-22414_firmware = 1.8`\n- `d0104s1ula-22450_firmware = 1.8`\n- `d0108s1ula-22452_firmware = 1.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}