XSS Vulnerability in pxc_portSecCfg.php Affects Network Device Management
CVE-2025-41746
7.1HIGH
What is CVE-2025-41746?
An XSS vulnerability in the pxc_portSecCfg.php file could allow an unauthenticated remote attacker to craft a malicious POST request. This request may exploit the web-based management interface, tricking an authenticated user into changing specific device configuration parameters. Importantly, the vulnerability does not enable access to deeper system resources or privileged functionalities, as the session cookie is secured with the httpOnly flag. This limitation helps prevent session hijacking of authenticated users.
Affected Version(s)
FL NAT 2008 0.0.0 < 3.50
FL NAT 2208 0.0.0 < 3.50
FL NAT 2304-2GC-2SFP 0.0.0 < 3.50
References
CVSS V3.1
Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube