XSS Vulnerability in Web Management Interface of Affected Device by Vendor

CVE-2025-41695

What is CVE-2025-41695?

An XSS vulnerability identified in dyn_conn.php allows an unauthenticated remote attacker to exploit the web management interface of a device. This vulnerability enables the attacker to manipulate POST requests, tricking authenticated users into unknowingly altering configuration parameters. While this flaw is concerning, it does not grant access to deeper system-level resources or privileges, as access remains constrained to the context of the web application. Importantly, the session cookie is secured with the httpOnly flag, thus minimizing the risk of session hijacking.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References