PT-2025-49817 · Unknown · Pxc Portcntr2.Php

D. Blagojevic + 3 · Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-41745

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions versions prior to 2025-41745

Description An XSS issue exists in the pxc portCntr2.php file. An unauthenticated remote attacker can manipulate an authenticated user into sending a crafted POST request to the device, potentially altering parameters accessible through the web-based management interface (WBM). The vulnerability’s impact is limited to device configuration parameters within the web application’s scope and does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41745

Affected Products

Pxc Portcntr2.Php

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41745 · Security Note
• https://certvde.com/de/advisories/VDE-2025-071 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41745 · Vendor Advisory
• https://t.me/CVEtracker/39246 · Telegram Post
• https://twitter.com/CVEnew/status/1998355347304747115 · Twitter Post