CVE-2025-10204
Unauth Admin Reset Password on AC Smart II
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- September 10, 2025
- Published Date
- September 14, 2025
- Last Updated
- September 15, 2025
- Vendor
- LG Electronics
- Product
- AC Smart II
- Description
- A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to change the administrator password without verifying login status or user permissions.
- Tags
- Exploitation
- none
- Technical Impact
- partial
- Exploited in the Wild
- Yes (2026-01-25 00:00:00 UTC) Source
nuclei_scanner
CVSS Scores
CVSS v4.0
7.1 - HIGH
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC Information
Exploit Status
References
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| The Shadowserver (via CIRCL) | 2026-01-25 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10204.yaml | 2026-06-01 15:34:40 UTC |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel
-
Detected by Nuclei