{"id":"CVE-2025-52357","aliases":["EUVD-2025-20871","GHSA-8pjw-5whg-c6q5"],"status":"published","title":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome...","description":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.25567,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2025-07-09T00:00:00Z","modified":"2026-06-17T09:36:24Z","exploits":[{"source":"pocgithub","id":"wrathfulDiety/CVE-2025-52357","title":"wrathfulDiety/CVE-2025-52357","date":"2025-06-12","url":"https://github.com/wrathfulDiety/CVE-2025-52357"}],"references":[{"url":"https://github.com/wrathfulDiety/fd602gw-dx-r410-xss-advisory/blob/main/README.md"},{"url":"https://github.com/wrathfulDiety/CVE-2025-52357"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52357"},{"url":"https://github.com/advisories/GHSA-8pjw-5whg-c6q5"}],"sources":{"cve":[{"id":"CVE-2025-52357","description":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.","status":"published","published":"2025-07-09T00:00:00Z","modified":"2025-07-09T20:18:32.476Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-20871","description":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.","status":"published","published":"2025-07-09T00:00:00Z","modified":"2025-07-09T20:18:32Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:10.118111Z"}],"ghsa":[{"id":"GHSA-8pjw-5whg-c6q5","title":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome...","description":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.","status":"published","published":"2025-07-09T21:31:17Z","modified":"2025-07-09T21:31:27Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:58.788337Z"}],"nvd":[{"id":"CVE-2025-52357","description":"Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.","status":"published","published":"2025-07-09T20:15:27.053Z","modified":"2026-06-17T09:36:24.737Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:17.727956Z"}]}}