XSS Vulnerability in Web Management Interface of Affected Product by Vendor
CVE-2025-41749
7.1HIGH
What is CVE-2025-41749?
An XSS vulnerability exists in the port_util.php file, allowing unauthenticated remote attackers to manipulate web application parameters by tricking authenticated users into clicking malicious links. While this vulnerability does not grant access to confidential system-level resources, it poses a risk to device configuration through the web management interface. The session cookie is protected with the httpOnly flag, providing a level of security against session takeover by attackers.
Affected Version(s)
FL NAT 2008 0.0.0 < 3.50
FL NAT 2208 0.0.0 < 3.50
FL NAT 2304-2GC-2SFP 0.0.0 < 3.50
References
CVSS V3.1
Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube