CVE-2025-56311: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
To mitigate CVE-2025-56311, organizations should first verify if they use the affected FD602GW-DX-R410 routers with firmware version 2.2.14. If so, they should contact Shenzhen C-Data Technology Co. for firmware updates or patches that implement proper CSRF protections such as anti-CSRF tokens on sensitive endpoints. In the absence of official patches, network administrators should restrict access to the router's web management interface by limiting it to trusted IP addresses or VPN-only access to reduce exposure. Implementing multi-factor authentication (MFA) for administrative access can reduce the risk of credential compromise. Administrators should be trained to avoid visiting untrusted websites while logged into router management interfaces to prevent social engineering exploitation. Monitoring router logs for unexpected reboots and unusual administrative activity can help detect exploitation attempts. Network segmentation can isolate critical routers from general user networks to limit attack vectors. Finally, organizations should maintain an inventory of network devices to quickly identify and remediate vulnerable equipment.
Description
In Shenzhen C-Data Technology Co. FD602GW-DX-R410 (firmware v2.2.14), the web management interface contains an authenticated CSRF vulnerability on the reboot endpoint (/boaform/admin/formReboot). An attacker can craft a malicious webpage that, when visited by an authenticated administrator, causes the router to reboot without explicit user consent. This lack of CSRF protection on a sensitive administrative function can lead to denial of service by disrupting network availability.