{"id":"CVE-2025-1614","state":"PUBLISHED","title":"FiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scripting","description":"A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-02-24T03:00:13.961Z","updatedAt":"2025-02-24T11:39:40.185Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["FiberHome AN5506-01A ONU GPON"],"affected":[{"vendor":"FiberHome","product":"AN5506-01A ONU GPON","versions":[{"version":"RP2511","status":"affected"}],"modules":["Port Forwarding Submenu"]}],"references":["https://vuldb.com/?id.296604","https://vuldb.com/?ctiid.296604","https://vuldb.com/?submit.501365"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1614.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1614","state":"PUBLISHED","datePublished":"2025-02-24T03:00:13.961Z","dateUpdated":"2025-02-24T11:39:40.185Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-02-23T07:14:23.201Z"},"containers":{"cna":{"title":"FiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in FiberHome AN5506-01A ONU GPON RP2511 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei /goform/portForwardingCfg der Komponente Port Forwarding Submenu. Dank der Manipulation des Arguments pf_Description mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"FiberHome","product":"AN5506-01A ONU GPON","versions":[{"version":"RP2511","status":"affected"}],"modules":["Port Forwarding Submenu"]}],"references":[{"url":"https://vuldb.com/?id.296604","name":"VDB-296604 | FiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.296604","name":"VDB-296604 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.501365","name":"Submit #501365 | FiberHome AN5506-01A ONU GPON RP2511 Cross Site Scripting","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-02-24T03:00:13.961Z"},"timeline":[{"time":"2025-02-23T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-02-23T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-02-23T08:19:35.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Havook (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-24T11:39:20.552656Z","id":"CVE-2025-1614","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-24T11:39:40.185Z"}}]}}}