CVE-2025-2072

A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a web page without proper sanitization or encoding. Exploiting this vulnerability, an attacker can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, data theft, and other malicious actions. Affected WebUI parameters are "h", "hd", "p", "pi", "s", "t", "x", "y".

CVSS

No CVSS.

References

Link	Resource
https://www.fast-lta.de/de/fast/silent-bricks-software-2-63

Configurations

No configuration.

History

No history.

Information

Published : 2025-03-31 09:15

Updated : 2026-06-17 09:06

NVD link : CVE-2025-2072

Mitre link : CVE-2025-2072

CVE.ORG link : CVE-2025-2072

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-2072", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2072", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-31T16:16:46.834770Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "affectedData": [{"vendor": "FAST LTA", "modules": ["Web User Interface"], "product": "FAST LTA Silent Brick WebUI", "versions": [{"status": "affected", "version": "WebUI Release 2.45 (Linux 5.4.109-gentoo-FAST)", "lessThan": "2.63.04", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unknown"}]}], "published": "2025-03-31T09:15:14.987", "references": [{"url": "https://www.fast-lta.de/de/fast/silent-bricks-software-2-63", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a web page without proper sanitization or encoding. Exploiting this vulnerability, an attacker can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, data theft, and other malicious actions. Affected WebUI parameters are \"h\", \"hd\", \"p\", \"pi\", \"s\", \"t\", \"x\", \"y\"."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de cross-site scripting (XSS) reflejado en la interfaz web de FAST LTA Silent Brick, que permite a los atacantes inyectar c\u00f3digo JavaScript malicioso en las p\u00e1ginas web que visitan los usuarios. Este problema surge cuando la informaci\u00f3n proporcionada por el usuario se gestiona incorrectamente y se refleja directamente en la salida de una p\u00e1gina web sin la debida codificaci\u00f3n ni limpieza. Al explotar esta vulnerabilidad, un atacante puede ejecutar JavaScript arbitrario en el navegador de la v\u00edctima, lo que podr\u00eda provocar secuestro de sesi\u00f3n, robo de datos y otras acciones maliciosas. Los par\u00e1metros de la interfaz web afectados son \"h\", \"hd\", \"p\", \"pi\", \"s\", \"t\", \"x\" e \"y\"."}], "lastModified": "2026-06-17T09:06:15.037", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}