PT-2025-24097 · Idf+1 · Idf+1

Published 2025-06-06 · Updated 2025-06-06 · CVE-2025-41367

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions IDF versions 0.10.0-0C03-03 ZLF versions 0.10.0-0C03-04

Description The issue is a Stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to store malicious JavaScript payload in the software, which will run in the victim's browser. To exploit this vulnerability, an attacker must authenticate to the device and execute certain commands that require permissions higher than the view permission.

Recommendations For IDF version 0.10.0-0C03-03, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ZLF version 0.10.0-0C03-04, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41367

Affected Products

Idf

Zlf

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41367 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products · Note
• https://t.me/cvenotify/124902 · Telegram Post
• https://twitter.com/CVEnew/status/1930965195414802752 · Twitter Post