PT-2025-11186 · Fs · Fs Inc S3150 8T2F Switch

Published 2025-03-13 · Updated 2025-04-03 · CVE-2025-25625

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FS Inc S3150 8T2F Switch versions s3150-8t2f-switch-fsos-220d 118101 and web firmware v2.2.2

Description A stored cross-site scripting vulnerability exists in the web management interface of the FS model S3150-8T2F switches. This allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages that present the user name without encoding special characters will cause the injected code to be parsed by the browsers of other users accessing the web interface.

Recommendations For FS Inc S3150 8T2F Switch versions s3150-8t2f-switch-fsos-220d 118101 and web firmware v2.2.2, consider disabling the web management interface until a patch is available. Restrict access to the web interface to minimize the risk of exploitation. Avoid using the user name field in the web interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25625

Affected Products

Fs Inc S3150 8T2F Switch

References · 7

• 🔥 https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2025-25625 · Exploit
• https://osv.dev/vulnerability/CVE-2025-25625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25625 · Security Note
• https://twitter.com/dailycve/status/1907884434822406289 · Twitter Post
• https://t.me/cvenotify/117622 · Telegram Post
• https://t.me/cvedetector/20218 · Telegram Post
• https://twitter.com/CVEnew/status/1900209137075511788 · Twitter Post