PT-2025-49818 · Unknown · Pxc Portseccfg.Php

D. Blagojevic + 3 · Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-41746

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pxc portSecCfg.php (affected versions not specified)

Description An XSS vulnerability exists in the pxc portSecCfg.php file. An unauthenticated remote attacker can exploit this to manipulate an authenticated user into sending a crafted POST request to the device. This allows modification of parameters accessible through the web-based management interface (WBM). The vulnerability’s impact is limited to device configuration parameters within the web application’s context and does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking. The vulnerable file is pxc portSecCfg.php. The attack involves manipulating a POST request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41746

Affected Products

Pxc Portseccfg.Php

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41746 · Security Note
• https://osv.dev/vulnerability/CVE-2025-41746 · Vendor Advisory
• https://certvde.com/de/advisories/VDE-2025-071 · Vendor Advisory
• https://t.me/CVEtracker/39249 · Telegram Post
• https://twitter.com/CVEnew/status/1998355348324036784 · Twitter Post