PT-2025-30277 · Unknown · Extremecontrol

Published 2025-07-21 · Updated 2025-07-21 · CVE-2025-6235

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ExtremeControl versions prior to 25.5.12

Description The application contains a cross-site scripting (XSS) issue in a login interface. This is due to improper handling of user-supplied input within HTML attributes, which allows an attacker to inject script code that may execute in a user's browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context.

Recommendations Update to version 25.5.12 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-6235

Affected Products

Extremecontrol

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-6235 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6235 · Vendor Advisory
• https://extreme-networks.my.site.com/ExtrArticleDetail?an=000128019 · Vendor Advisory
• https://t.me/cvenotify/129692 · Telegram Post
• https://twitter.com/CVEnew/status/1947300336873492704 · Twitter Post
• https://extreme-networks.my.site.com · Note
• https://twitter.com/VulmonFeeds/status/1947320414830498017 · Twitter Post