PT-2026-7117 · Hitron · Hitron Hi3120

Published 2026-02-09 · Updated 2026-02-09 · CVE-2025-63354

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hitron HI3120 version 7.2.4.5.2b1

Description The Hitron HI3120 device contains a flaw where it does not correctly manage input, leading to the possibility of stored cross-site scripting (XSS). This occurs through the Parental Control feature when a new filter is created. An attacker can inject and execute JavaScript code due to this improper input handling.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63354

Affected Products

Hitron Hi3120

References · 6

• 🔥 https://github.com/kakarotossj3/CVEs/blob/main/Hitron/XSS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63354 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63354 · Vendor Advisory
• https://t.me/CVEtracker/44218 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2020932702094950725 · Twitter Post
• https://twitter.com/CVEnew/status/2020888083311276059 · Twitter Post