External risk intelligence

NJHYST HY511 POE Configuration File Download and Credential Theft Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65212

The vulnerability affects a POE (Power over Ethernet) core device management interface. Such devices are typically deployed as edge networking hardware or appliance portals that require administrative access, making their management interfaces commonly reachable over the network and frequently exposed to allow for remote configuration and monitoring.

Njhyst Hy511 Firmware

before 2.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in NJHYST HY511 POE core technology that could allow unauthorized access to sensitive configuration details. This vulnerability bypasses standard login procedures, potentially exposing credentials and enabling direct administrative control of affected devices. The main concern at this stage is confirming if this technology is in use within our environment.

Unprotected access to device configurations.
Allows direct administrative control.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing the device over the network without needing any credentials. They would then request the device's configuration file, which contains sensitive information like usernames and MD5 passwords. With these credentials, the attacker could bypass the login page and gain full administrative access to the device's backend.

Network access required, no authentication needed.
Request configuration file to obtain credentials.
Gain administrative access to backend.

Live Threat

Current exploitation, exposure, and threat context

An attacker could gain unauthorized access to the device's management backend by exploiting insufficient cookie verification. This would allow them to bypass the login page, access the core configuration file, and retrieve credentials.

Device configuration files.
Directly request configuration file.
Gain administrative access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the NJHYST HY511 POE core and its plugins. Owners of network infrastructure or edge devices are likely responsible for remediation. The first practical step is to identify all deployed HY511 devices, confirm their network exposure and business criticality, and then engage the appropriate teams for a planned remediation.

Network infrastructure teams should own this.
Verify exposed device reachability.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NJHYST HY511 POE device?

The NJHYST HY511 is a Power over Ethernet (POE) core component and networking device. These systems are typically used as edge networking hardware, acting as appliance portals that manage network power and data distribution. They provide a management interface for administrators to monitor and configure network settings.

How does CVE-2025-65212 work?

This vulnerability is classified as CWE-565, or Relying on Untrusted Inputs in a Security Decision. Essentially, the device fails to properly verify the session cookies used to restrict access. Because of this flaw, the system allows users to retrieve sensitive configuration files through a direct web request, bypassing the security checks that would normally block unauthorized access.

Do I need to be logged in to trigger this bug?

No. The flaw specifically allows an attacker to bypass the login process entirely. An attacker does not need prior authentication or valid credentials to request the configuration file. It is important to note that simply visiting the device's main dashboard is not the trigger; the issue occurs when a request is specifically directed toward the configuration file's address.

Is my NJHYST HY511 at risk?

According to Halo Surface Signal, this risk is considered likely because these devices serve as edge networking portals. Their management interfaces are frequently exposed to the network to enable remote configuration and monitoring. If your HY511 device is reachable over an untrusted network or the internet, it is at a higher risk of being targeted by this unauthorized file access.

What should I do if I use this technology?

Your first step is to create an inventory of all deployed HY511 devices in your infrastructure. Once identified, verify which units are accessible over your network and assess their business criticality. Coordinate with your network administration teams to monitor these devices and prepare for firmware updates, as you must ensure the core technology is at version 2.1 or later.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.