CVE-2025-54859
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In desknet's NEO V9.0R2.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
Risk Assessment
An attacker could inject malicious scripts that execute in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Upgrade desknet's NEO to a version newer than V9.0R2.0 if available, or apply security patches.
Other vulnerabilities in desknet's NEO
See all- CVE-2025-58426Medium
desknet's NEO versions V4.0R1.0 to V9.0R2.0 contain a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
- CVE-2025-58079Medium
In desknet's NEO V4.0R1.0 to V9.0R2.0, there is an Improper Protection of Alternate Path (CWE-424) vulnerability in the AppSuite that allows an attacker to create malicious AppSuite applications.
- CVE-2025-55072Medium
In desknet's NEO V2.0R1.0 to V9.0R2.0, there is a Stored Cross-Site Scripting (XSS) vulnerability that allows execution of arbitrary JavaScript in a user's web browser.
- CVE-2025-54760Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
- CVE-2025-24833Medium
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allows execution of arbitrary JavaScript in a user's web browser. The malicious script is persistently stored and executed when the infected page is viewed.
Original NVD description (English source)
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS