XSS Vulnerability in Web Management Interface of Networking Device by Vendor
CVE-2025-41747
7.1HIGH
What is CVE-2025-41747?
An XSS vulnerability identified in the pxc_vlanIntfCfg.php component allows an unauthorized remote attacker to deceive an authenticated user into issuing a manipulated POST request to the networking device. This could alter various configurable parameters accessible through the web-based management interface. The security flaw is confined to the device's configuration settings, without allowing access to more sensitive system-level resources or functions. Importantly, the session cookies are protected by the httpOnly flag, mitigating the risk of session hijacking.
Affected Version(s)
FL NAT 2008 0.0.0 < 3.50
FL NAT 2208 0.0.0 < 3.50
FL NAT 2304-2GC-2SFP 0.0.0 < 3.50
References
CVSS V3.1
Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube