CVE-2018-25127

SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface

Medium5.1EPSS 0.23%

Published: 24 Dec 2025
Updated: 24 Dec 2025
Reserved: 24 Dec 2025
Assigned by: VulnCheck

Description

SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that submit forged requests to create admin accounts by tricking logged-in users into visiting a malicious site.

Scores

CVSS scores of CVE-2018-25127, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVDNVD · Deferred	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.23% · top 86% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

CWE-352: Cross-Site Request Forgery (CSRF) (opens in a new tab)All about CWE-352 and its CVEs

Affected products

SOCA Technology Co., Ltd · SOCA Access Control System
- affected 180612
- affected 170000
- affected 141007

References (3)

ExploitDB-46834 (opens in a new tab)exploit
SOCA Technology Product Homepage (opens in a new tab)product
Zero Science Lab Disclosure (ZSL-2019-5520) (opens in a new tab)third-party-advisoryexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25127](https://trackcve.app/badge/CVE-2018-25127.svg)](https://trackcve.app/cve/CVE-2018-25127)

Record last updated 24 Dec 2025, 20:27 UTC.