Vulnerability · Published Sep 16, 2025 · Assigned by CERT-In

CVE-2025-10546Cross-Site Scripting (XSS) Vulnerability in PPC XPON ONT Wi-Fi Router

Medium 5.1

In plain English

A medium-severity cross-site scripting in PPC XPON ONT (Optical Network Terminal) 2K15X from PPC Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 57.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal. A remote attacker could exploit this vulnerability by injecting malicious JavaScript into the vulnerable parameter, leading to a reflected Cross-Site Scripting (XSS) attack on the targeted system.

Affected products (as reported)

Vendor	Product	Versions
PPC Technologies	PPC XPON ONT (Optical Network Terminal) 2K15X	v2.3.15PPCLv1.0.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0215 third-party-advisory