Stored XSS Vulnerability in Desknet's NEO Software by Desknet, Inc.
CVE-2025-54859

4.6MEDIUM

Key Information:

Vendor

Neojapan Inc.

Status
Desknet's Neo
Vendor
CVE Published:
16 October 2025

What is CVE-2025-54859?

A stored cross-site scripting (XSS) vulnerability exists in Desknet's NEO software versions V9.0R2.0 and earlier. This weakness allows an attacker to inject and execute arbitrary JavaScript code within a victim's web browser, leading to the potential theft of sensitive user information and unauthorized actions on behalf of the user. Proper security practices and timely updates are crucial to mitigate risks associated with this vulnerability.

Affected Version(s)

desknet's NEO V9.0R2.0 and earlier

References

https://www.desknets.com/neo/support/mainte/17475/
https://jvn.jp/en/jp/JVN90757550/

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54859 : Stored XSS Vulnerability in Desknet's NEO Software by Desknet, Inc.