PT-2025-13449 · Unknown · Hgw-Bl1500Hm

Published 2025-03-28 · Updated 2025-03-29 · CVE-2025-27574

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HGW-BL1500HM versions 002.002.003 and earlier

Description A cross-site scripting issue exists in the USB storage file-sharing function. This could allow an arbitrary script to be executed on the web browser of a user accessing the configuration page or functions from the LAN side of the product.

Recommendations For HGW-BL1500HM versions 002.002.003 and earlier, consider disabling the USB storage file-sharing function until a patch is available to prevent potential exploitation. Restrict access to the configuration page and functions accessible only from the LAN side to minimize risk. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27574

Affected Products

Hgw-Bl1500Hm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-27574 · Security Note
• https://twitter.com/CVEnew/status/1905811689334833187 · Twitter Post
• https://jvn.jp/en/jp/JVN04278547 · Note
• https://t.me/cvenotify/116684 · Telegram Post
• https://t.me/cvedetector/21384 · Telegram Post
• https://t.me/cvetracker/20154 · Telegram Post
• https://kddi-tech.com/contents/appendix_L2_06.html#64433e4a-8946-9c06-bddf-91cbfe56c8e5 · Note