CVE-2025-25625

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-25625
A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages which then present the user name without encoding special characters will then cause the injected code to be parsed by the browsers of other users accessing the web interface.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2025-25625 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:fs:s3150-8t2f_firmware:2.2.2:*:*:*:*:*:*:*
cpe:2.3:o:fs:s3150-8t2f_firmware:s3150-8t2f-switch-fsos-220d_118101:*:*:*:*:*:*:*
cpe:2.3:h:fs:s3150-8t2f:*:*:*:*:*:*:*:*
History

03 Apr 2025, 18:26

Type Values Removed Values Added
References () https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2025-25625 - () https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2025-25625 - Third Party Advisory
First Time Fs s3150-8t2f Firmware
Fs
Fs s3150-8t2f
CPE cpe:2.3:o:fs:s3150-8t2f_firmware:2.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fs:s3150-8t2f:*:*:*:*:*:*:*:*
cpe:2.3:o:fs:s3150-8t2f_firmware:s3150-8t2f-switch-fsos-220d_118101:*:*:*:*:*:*:*

19 Mar 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CWE CWE-79

18 Mar 2025, 17:15

Type Values Removed Values Added
Summary
  • (es) FS Inc S3150 8T2F Switch s3150-8t2f-switch-fsos-220d_118101 tiene una vulnerabilidad de Cross Site Scripting (XSS) almacenado en la interfaz de administración web.
Summary (en) FS Inc S3150 8T2F Switch s3150-8t2f-switch-fsos-220d_118101 has a stored cross-site scripting (XSS) vulnerability in the web management interface. (en) A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages which then present the user name without encoding special characters will then cause the injected code to be parsed by the browsers of other users accessing the web interface.

13 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-13 15:15

Updated : 2025-04-03 18:26

NVD link : CVE-2025-25625

Mitre link : CVE-2025-25625

CVE.ORG link : CVE-2025-25625

JSON object : View

Products Affected

fs

  • s3150-8t2f_firmware
  • s3150-8t2f
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')