CVE-2026-25789CWE-79

Affected devices do not properly validate and sanitize filenames on the Firmware Update page

High · published May 12, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
EPSS
0.00473 · 39.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-12T08:21Z
EPSS history
Timeline
  • 12 MAY 08:21Z
    Affected devices do not properly validate and sanitize filenames on the Firmware Update page
    cvelistv5