PT-2025-47572 · Unknown · Pyxis Signage

Tunahan Tekeoğlu · Published 2025-11-20 · Updated 2026-03-06 · CVE-2025-0643

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pyxis Signage versions through 31012025

Description Pyxis Signage is affected by an Improper Neutralization of Input During Web Page Generation, specifically a Stored Cross-Site Scripting (XSS) issue. This allows for persistent JavaScript execution in the browsers of administrators. A real-world scenario involves compromising signage to display phishing content in public locations such as corporate lobbies, retail stores, and airports. The issue impacts digital signage systems deployed in public spaces with limited monitoring. There are over 3.2 million potentially affected devices worldwide. The vulnerability can be exploited through the injection of malicious JavaScript code.

Recommendations Versions prior to 31012025 should be updated.

Fix

DoS

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-0643

Affected Products

Pyxis Signage

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-0643 · Security Note
• https://twitter.com/vuln_tracker/status/2029814479031288270 · Twitter Post
• https://usom.gov.tr/bildirim/tr-25-0404 · Note
• https://twitter.com/CVEnew/status/1991502514454220914 · Twitter Post
• https://twitter.com/gothburz/status/1991669231222390972 · Twitter Post
• https://twitter.com/fofabot/status/2029776816735670393 · Twitter Post