XSS Vulnerability in Web-Based Management of Networking Device from Vendor

CVE-2025-41750

What is CVE-2025-41750?

An XSS vulnerability located in the pxc_PortCfg.php file of a web-based management interface allows an unauthenticated remote attacker to deceive an authenticated user into clicking a malicious link. This manipulation could lead to unauthorized changes to device configuration parameters available through the web management tool. Importantly, the vulnerability restricts access to these parameters within the confines of the web application and does not extend to system-level resources or privileged functions. Additionally, the session cookie benefits from the httpOnly flag, providing a layer of protection against session hijacking.

References