Cross-Site Scripting Vulnerability in HGW-BL1500HM by KDDI
CVE-2025-27574

3.6LOW

Key Information:

Vendor: Kddi Corporation
Status: Hgw-bl1500hm
Vendor: CVE Published:; 28 March 2025

🔔 Create Kddi Corporation Vulnerability Alert

What is CVE-2025-27574?

A cross-site scripting vulnerability has been identified in the USB storage file-sharing functionality of the HGW-BL1500HM device. This flaw could allow an attacker to execute arbitrary scripts on the web browser of any user accessing the device's configuration page or functions that are accessible from the LAN side. Exploitation of this vulnerability may lead to unauthorized actions on the affected user's device, posing significant risks to both data integrity and user privacy.

Affected Version(s)

HGW-BL1500HM Ver 002.002.003 and earlier

References

https://kddi-tech.com/contents/appendix_L2_06.html#64433e...

https://jvn.jp/en/jp/JVN04278547/

CVSS V3.0

Score:

3.6

Severity:

LOW

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Physical

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 28, 2025
Vulnerability Reserved
Mar 11, 2025

CVE-2025-27574 Data

JSON