Reflected Cross-Site Scripting Vulnerability in FAST LTA Silent Brick WebUI
CVE-2025-2072

5.1MEDIUM

Key Information:

Vendor

Fast Lta

Status
Fast Lta Silent Brick Webui
Vendor
CVE Published:
31 March 2025

What is CVE-2025-2072?

A reflected Cross-Site Scripting (XSS) vulnerability exists in the FAST LTA Silent Brick WebUI due to inadequate handling of user-input. When specific parameters such as 'h', 'hd', 'p', 'pi', 's', 't', 'x', or 'y' are processed without proper sanitization, an attacker can exploit this flaw to inject malicious JavaScript into web pages. This allows for malicious actions such as session hijacking or data theft, affecting users who interact with the compromised web pages.

Affected Version(s)

FAST LTA Silent Brick WebUI Linux WebUI Release 2.45 (Linux 5.4.109-gentoo-FAST) < 2.63.04

References

https://www.fast-lta.de/de/fast/silent-bricks-software-2-63
release-notes

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stefan Mettler from CRYPTRON Security GmbH
.