Cross-Site Scripting Flaw in Web-Based Management for Affected Devices

CVE-2025-41745

What is CVE-2025-41745?

An unauthenticated remote attacker can exploit a cross-site scripting vulnerability in pxc_portCntr2.php. This flaw allows the attacker to trick an authenticated user into sending a manipulated POST request to the device. Such an action could alter configurable parameters accessible through the web-based management interface. However, despite this vulnerability, the attacker's options are constrained to adjusting only those device configurations and do not extend to critical system-level resources or privileged functions. The application's session cookie is secured with the httpOnly flag, which mitigates risks related to session hijacking.

References