CVE-2025-21603CWE-79

Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier

Medium · published January 8, 2025

CVSS v3.0
4.8
EPSS
0%
Percentile
21.8
In the wild
Unconfirmed
What it is

Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product and manipulates the device settings, an arbitrary script may be executed on the logged-in user's web browser when accessing a crafted URL.

The record
Technical detail
CVSS v3.0
4.8 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-08T03:30Z
EPSS history
Timeline
  • 08 JAN 03:30Z
    Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier
    cvelistv5