CVE-2025-56009 is a CSRF vulnerability affecting KeeneticOS devices prior to version 4.3. The issue resides in the "/rci" API endpoint, which does not properly validate requests to prevent unauthorized actions. Exploitation involves an attacker convincing a victim to visit a crafted webpage, which then sends unauthorized requests to the device, resulting in the addition of users with full permissions. This could lead to device takeover by unauthorized parties. The vulnerability has a CVSS v3.1 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

Successful exploitation allows an attacker to add users with full permissions to the affected KeeneticOS device, effectively enabling device takeover. The confidentiality impact is limited, and there is no direct integrity or availability impact reported. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid visiting untrusted websites while authenticated to the device and consider restricting access to the "/rci" API endpoint if possible. Monitor vendor communications for updates regarding patches or official mitigations.