[GHSA-p69p-39vf-6x53] CRLF-injection in KeeneticOS before 4.3 at "/auth" API...

[notdenied]

Updates

• Affected products
• CVSS v3
• References
• Summary

Comments
I am the author of this CVE. :)

Added title, published a small writeup, some other minor changes.

Not sure if I have to check "Integrity" and "Availability" while the impact is router takeover (RCE) so skip them for now.

[notdenied]

Also, if it is possible, may you add me (Andrey Ryzhov) to the credits section, please? This is my CVE (if you need a proof, feel free to contact me).
I've already contacted MITRE for this addition, but also want to add it on Github.

[shelbyc]

Hi @notdenied, I can't review this advisory (and therefore can't add credit) because I can't find anything about KeeneticOS in Pub or any of the GitHub Advisory Database's supported ecosystems. From what I can see at https://github.com/orgs/keenetic/repositories?type=all, the vast majority of KeeneticOS repos are dominated by C. Does CVE-2025-56007 affect any packages in a supported ecosystem?