Emlog Pro CVE-2025-61930

Exploitation requires that a victim administrator be actively authenticated to the Emlog Pro admin interface AND be induced (via UI:R user interaction) to visit or render an attacker-controlled page that issues a forged POST to the password-change endpoint. The key limiting factors are: (1) the target must be a logged-in privileged user, (2) successful social engineering is needed to deliver the malicious request, and (3) the endpoint must lack effective anti-CSRF protections (the root cause). No special non-default product configuration is called out in the description; all Emlog Pro versions 2.5.19 and earlier are affected, and because no patched version exists, exploitation cannot currently be eliminated by upgrading.

This is a CWE-352 Cross-Site Request Forgery flaw with a vendor/NVD-provided CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The high score is driven by network reach, low complexity, no attacker privileges, and high C/I/A impact (admin account takeover). However, the required user interaction (UI:R) is a meaningful mitigating factor: exploitation depends on tricking an already-authenticated administrator into visiting an attacker-controlled page, which lowers reliability compared to a fully automated remote flaw. Exploitation signals are mixed and partly missing: publicly available exploit code exists (reported via GitHub Security Advisory), but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation at time of analysis - POC availability should not be conflated with in-the-wild use. A notable aggravating factor is that no patched version exists as of publication, so affected deployments cannot remediate via upgrade and must rely on compensating controls. Net: a genuine, credible risk for internet-exposed Emlog Pro admin panels, but the social-engineering dependency and niche product footprint temper it below the raw 8.8 for most environments.

An attacker hosts a malicious web page containing an auto-submitting form (or embedded request) targeting the Emlog Pro admin password-change endpoint. A logged-in administrator who is lured into visiting the page unknowingly submits the crafted POST, silently resetting the admin password to an attacker-chosen value and granting full account takeover. Publicly available exploit/PoC code exists in the GitHub Security Advisory, lowering the effort required.