PT-2025-9121
CVE-2025-25430
·
Published
2025-02-28
·
Updated
2025-03-04
Description by
CVSS 3.1
4.8
MediumMetricsAV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Trendnet TEW-929DRU version 1.0.0.10
Description
The issue is related to a Stored Cross-site Scripting (XSS) vulnerability. It can be exploited via the
configname parameter on the "/cbi addcert.htm" API endpoint.Recommendations
For Trendnet TEW-929DRU version 1.0.0.10, consider restricting access to the "/cbi addcert.htm" page until a fix is available, and avoid using the
configname parameter in this endpoint to minimize the risk of exploitation. Found an issue in the description? Have something to add? Feel free to write us 👾