CVE-2025-11851

LowCVSS 3.5

Published: 16/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability in Apeman ID71 EN75.8.53.20 affects a function in the /set_alias.cgi file. Manipulation of the alias argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.

Risk Assessment

The risk for the organization is the possibility of remote script execution in the device's context, which could lead to device takeover or data theft.

Recommendation

Update the Apeman ID71 firmware to the latest version if available, or restrict access to the device.

Other vulnerabilities in Apeman ID71

CVE-2025-11852Medium
A vulnerability was found in Apeman ID71 218.53.203.117. An unknown function of the file /onvif/device_service in the ONVIF Service component allows manipulation resulting in missing authentication. The attack is possible remotely and the exploit has been made public.

Original NVD description (English source)

A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /set_alias.cgi. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS