CVE-2025-25612

HighCVSS 7.1

Published: 17/03/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

53th percentile - higher than 53% of all known CVEs

Summary

FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When saved, the script executes in the browser of any user accessing the affected page, including administrators.

Risk Assessment

The risk includes session hijacking of administrators, theft of credentials, and unauthorized actions in the switch management interface, potentially leading to network security breaches.

Recommendation

Immediately update the switch firmware to version S3150-8T2F_2.2.0D_135103 or later. Until the update is applied, restrict access to the administration interface to trusted IP addresses only.

Other vulnerabilities in FS Inc S3150-8T2F

CVE-2025-25613High
In FS Inc S3150-8T2F switches before version 2.2.0D Build 135103, authentication credentials (usernames and passwords) are transmitted in cookies as cleartext, only encoded with base64. Every POST request to the administrative interface exposes these credentials in an unencrypted form.

Original NVD description (English source)

FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.