Cross-Site Scripting Vulnerability in Web Management Interface of Network Device

CVE-2025-41752

What is CVE-2025-41752?

An XSS vulnerability exists in the pxc_portSfp.php script, allowing unauthenticated remote attackers to deceive authenticated users into clicking a malicious link. This can result in unauthorized modification of web-based management parameters without providing access to system-level resources or privileged functions. The vulnerability allows attackers to manipulate device configuration parameters exposed through the web application interface. While the session cookie is secured by the httpOnly flag, it is important to remain cautious as an effective exploitation could still impact user interactions with the web management features.

References