XSS Vulnerability in Vivaldi United Group iCONTROL+ Server
CVE-2025-52358

6.3MEDIUM

Key Information:

Vendor

Vivaldi United Group

Status
iCONTROL+ Server
Vendor
CVE Published:
29 July 2025

What is CVE-2025-52358?

A cross-site scripting (XSS) vulnerability exists in the iCONTROL+ Server by Vivaldi United Group, specifically affecting firmware version 4.7.8.0 and eden Logic version 5.32 and below. This flaw allows malicious actors to inject harmful JavaScript payloads into the application, which can be executed in the context of a victim's browser session. It occurs within error messages or edit-menu-item parameters, potentially leading to unauthorized actions or data leakage. Users are advised to implement security best practices and apply patches to mitigate this vulnerability.

References

https://vivaldigroup.it/en/
https://github.com/MatJosephs/CVEs/blob/main/CVE-2025-523...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52358 : XSS Vulnerability in Vivaldi United Group iCONTROL+ Server