PT-2025-15127

CVE-2025-3326

Published

2025-04-06

Updated

2025-04-08

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions iteaj iboot 物联网网关 version 1.1.3

Description A vulnerability has been found in the File Upload component, specifically affecting the /common/upload file. The manipulation of the File argument leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For iteaj iboot 物联网网关 version 1.1.3, consider disabling the File Upload component until a patch is available to prevent cross-site scripting attacks. Restrict access to the /common/upload file to minimize the risk of exploitation. Avoid using the File argument in the affected component until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Uglory

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers