CVE Alert: CVE-2025-0610 – Akınsoft – QR Menü

Risk verdict

High risk: a remotely exploitable CSRF flaw with no required user interaction could affect service availability.

Why this matters

The vulnerability enables state-changing actions across the QR Menu service over the network without authentication or user input, risking downtime or degraded functionality. In hospitality/retail environments where QR Menu is deployed, such disruption can hit customer service levels, bookings, and revenue unless quickly contained.

Most likely attack path

An attacker can target exposed QR Menu endpoints over the network, sending crafted requests that trigger privileged actions. With no user interaction or credentials required, automated or broad-scope exploitation is feasible, and any active sessions in victim environments could be leveraged to effect changes. Lateral movement is constrained to the affected application’s scope, but the impact on availability could be widespread within deployed installations.

Who is most exposed

Businesses using Akınsoft QR Menu in public-facing setups (e.g., restaurant kiosks, quick-service POS integrations, or cloud-hosted QR menus) that are reachable from the internet or poorly protected networks are most at risk.

Detection ideas

• Unusual spikes in state-changing requests to QR Menu endpoints without user actions.
• Requests lacking Referer/Origin validation or showing cross-origin patterns.
• 403/401 or 500 responses following automated requests from non-human sources.
• Logs showing repeated CSRF-like activity targeting the same actions.
• Correlation of events with uptime or service disruption incidents.

Mitigation and prioritisation

• Apply vendor patch to v1.05.12+ as a high-priority fix.
• Implement CSRF protections: tokens, SameSite cookies, and server-side checks on state-changing endpoints.
• Enforce strict authentication for sensitive actions or rearchitect to require user interaction.
• Deploy network/WAF rules to block unauthorised cross-origin requests targeting these endpoints.
• Plan staged rollout and verify availability post-patch; if KEV or EPSS indicates higher urgency, treat as priority 1.