PT-2025-11507 · Fs · Fs Inc S3150-8T2F

Published 2025-03-17 · Updated 2025-03-17 · CVE-2025-25612

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FS Inc S3150-8T2F versions prior to S3150-8T2F 2.2.0D 135103

Description The issue concerns Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the Time Range Name field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.

Recommendations For versions prior to S3150-8T2F 2.2.0D 135103, update to version S3150-8T2F 2.2.0D 135103 or later to resolve the issue. As a temporary workaround, consider restricting access to the Time Range Configuration functionality to minimize the risk of exploitation. Avoid using the Time Range Name field until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25612

Affected Products

Fs Inc S3150-8T2F

References · 6

• 🔥 https://github.com/secmuzz/CVE-2025-25612 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25612 · Security Note
• https://twitter.com/CVEnew/status/1901647336519962687 · Twitter Post
• http://fs.com · Note
• https://t.me/cvedetector/20477 · Telegram Post
• https://t.me/cvetracker/19289 · Telegram Post