PT-2025-23622 · Unicom · Unicom Focal Point

Ianis Bernard · Published 2025-06-03 · Updated 2025-06-03 · CVE-2025-43924

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Unicom Focal Point version 7.6.1

Description A Cross Site Scripting issue was found. The val parameter in SettingController for the "/fp/admin/settings/loginpage" endpoint and the rootserviceurl parameter in FriendsController for the "/fp/admin/settings/friends" endpoint are vulnerable to stored XSS attacks when entered by an admin.

Recommendations For Unicom Focal Point version 7.6.1, consider disabling the val parameter in SettingController and the rootserviceurl parameter in FriendsController as a temporary workaround until a patch is available. Restrict access to the "/fp/admin/settings/loginpage" and "/fp/admin/settings/friends" endpoints to minimize the risk of exploitation. Avoid using the val and rootserviceurl parameters in the affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-43924

Affected Products

Unicom Focal Point

References · 6

• https://unicomsi.com/security-advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43924 · Security Note
• https://unicomsi.com/products/focal-point · Note
• https://twitter.com/CVEnew/status/1929912686193598558 · Twitter Post
• https://t.me/cvetracker/25284 · Telegram Post