Mercku vulnerabilities
Published CVEs affecting Mercku products: 5 record(s), with severity, exploitation and fixes.
CVE-2025-62775
High · 8.0
CWE-669 Oct 22, 2025
Incorrect Resource Transfer Between Spheres in Mercku M6a
Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
CVE-2025-62774
Low · 3.1
CWE-331 Oct 22, 2025
On Mercku M6a devices through 2.1.0, the authentication system uses predictable session…
On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.
CVE-2025-62773
Low · 2.4
CWE-912 Oct 22, 2025
Mercku M6a devices through 2.1.0 allow TELNET sessions via a…
Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.
CVE-2025-62772
Low · 3.1
CWE-305 Oct 22, 2025
On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in…
On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.
CVE-2025-62771
High · 7.5
CWE-352 Oct 22, 2025
Cross-Site Request Forgery (CSRF) in Mercku M6a
Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.