External risk intelligence

Dasan DS2924 Authentication Bypass via Crafted Cookies

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63206

The vulnerability resides in the web-based management interface of a network switch. Such interfaces are frequently configured as administrative gateways, and while they should be restricted to internal management networks, they are commonly exposed or reachable in environments where remote network administration is required.

Missing Authentication

Dasannetworks Ds2924 Firmware

1.01.181.02.00

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the web interface of certain network switches, potentially allowing unauthorized access and elevated privileges. The issue stems from how authentication information is handled, making it possible for attackers to bypass security controls by manipulating stored browser data. Given the nature of network infrastructure, understanding the scope of affected devices is essential for maintaining operational integrity.

Attackers can bypass switch login.
Affects network management access.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on a Dasan Switch DS2924's web interface by storing specially crafted cookies in their browser. This allows them to access the interface without valid credentials, potentially leading to escalated privileges.

No authentication required for initial access.
Storing crafted cookies triggers vulnerability.
Gain escalated privileges through bypass.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication and gain elevated privileges on the affected Dasan Switch through its web-based interface. This could lead to unauthorized access and control over the switch's configuration and network traffic.

Unauthorized access to switch configuration.
Crafted cookies can bypass authentication.
Complete system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Dasan Switch web interface likely requires action from network infrastructure or platform teams. The first practical step is to identify all instances of the affected switch, determine their network exposure and business criticality, and locate the accountable owner for remediation planning.

Network or Platform teams own the issue.
Verify switch exposure and business criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dasan Switch DS2924?

The Dasan Switch DS2924 is a piece of networking hardware used to connect devices within a network. It includes a web-based management interface that allows administrators to configure settings and monitor traffic remotely through a browser. The affected firmware versions, 1.01.18 and 1.02.00, manage how users log in to this interface.

What does CWE-306 mean for CVE-2025-63206?

CWE-306 refers to a 'Missing Authentication for Critical Function' weakness. In the context of CVE-2025-63206, it means the switch fails to properly verify a user's identity before granting access to sensitive administrative controls. Because the system does not enforce a proper login check for certain actions, it allows unauthorized users to skip the authentication process entirely.

How is this authentication bypass triggered?

An attacker triggers this vulnerability by manually placing specially crafted cookies into their web browser while visiting the switch's management page. Simply browsing the site normally does not trigger the bug; the attacker must deliberately inject or modify the browser data to mimic an authenticated session. Once this malicious cookie is stored, the interface accepts it as valid, granting the user administrative privileges without ever requiring a password.

Is my device at risk based on Halo Surface Signal?

If your DS2924 management interface is reachable over the internet, Halo Surface Signal flags this as a higher concern. While these interfaces are intended for internal management, they are frequently exposed to broader networks for remote administration. Devices that are strictly isolated within a secure, non-routable internal management network face a lower immediate risk of external exploitation compared to those accessible from the public internet.

Do I need to update my switch immediately?

Your first step should be to create an inventory of all DS2924 switches in your environment to understand where they are deployed. Once you have identified them, assess whether they are exposed to the public network or restricted to internal traffic. After evaluating their network position and business criticality, coordinate with your infrastructure team to plan and apply the necessary firmware updates during your next scheduled maintenance window.

References

github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.