Vulnerability details
CVE-2025-25612
CVSS 3.1
7.1High
Official description
FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| No product information recorded. | |||
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-03-17
- Last updated
- 2026-07-05
- State
- Published
- Assigner (CNA)
- mitre
Exploit prediction (EPSS)
0.97%
Probability of exploitation in 30 days
62.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')