Vulnerability · Published Mar 4, 2025 · Assigned by mitre
CVE-2025-26202
Medium 4.3
In plain English
A medium-severity cross-site scripting in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an administrator views the passphrase via the "Click here to display" option on the Status page
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N