PT-2025-13448 · Unknown · Hgw-Bl1500Hm

Published 2025-03-28 · Updated 2025-03-29 · CVE-2025-27567

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HGW-BL1500HM versions 002.002.003 and earlier

Description A cross-site scripting issue exists in the NickName registration screen. This could allow an arbitrary script to be executed on the user's web browser when using the configuration page or functions accessible from the LAN side of the product.

Recommendations For HGW-BL1500HM versions 002.002.003 and earlier, consider restricting access to the NickName registration screen until a fix is available. As a temporary workaround, avoid using the NickName registration feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27567

Affected Products

Hgw-Bl1500Hm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-27567 · Security Note
• https://t.me/cvenotify/116683 · Telegram Post
• https://jvn.jp/en/jp/JVN04278547 · Note
• https://twitter.com/CVEnew/status/1905811690286874906 · Twitter Post
• https://t.me/cvedetector/21383 · Telegram Post
• https://t.me/cvetracker/20153 · Telegram Post
• https://kddi-tech.com/contents/appendix_L2_06.html#64433e4a-8946-9c06-bddf-91cbfe56c8e5 · Note