CVE-2025-65289: Mr816 Firmware: siteler arası betik çalıştırma (XSS)

Açıklama (NVD)

A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the context of an administrator's browser (for example after DHCP release/renew triggers the interface to display the stored hostname). Because the management interface uses weak/basic authentication and does not properly protect or isolate session material, the XSS can be used to exfiltrate the admin session and perform administrative actions.

Özet bilgiler

Ürün

Mercurycom Mr816 Firmware

CVSS v3.1

6.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

%0,32 (yüzdelik 25)

CWE

CWE-79

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• damiri.fr
• CWE-79