XSS in N/a
CVE-2025-25612
FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (58.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-25612?
- CVE-2025-25612 is a high-severity vulnerability in N/a, classified under Cross-site Scripting. CVSS score: 7.1/10. Published 2025-03-17.
- How severe is CVE-2025-25612?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2025-25612 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.