Stored Cross-Site Scripting Vulnerability in Linksys E5600 by Linksys
CVE-2025-29231

6.1MEDIUM

Key Information:

Vendor

Linksys
Status
Linksys E5600
Vendor
CVE Published:
16 December 2025

What is CVE-2025-29231?

A stored cross-site scripting (XSS) vulnerability exists in the page_save component of Linksys E5600 firmware version V1.1.0.26. This vulnerability allows attackers to inject malicious scripts or HTML code through the hostname and domainName parameters. Successful exploitation enables unauthorized execution of scripts in the user's browser, potentially leading to sensitive data exposure or session hijacking.

References

https://github.com/JZP018/Vuln/blob/main/linsys/E5600/XSS...
https://github.com/Suryaandave/CVES/tree/main/CVE-2025-29231

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.