CVE-2025-65289
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mercurycom | mr816_firmware | 081c3114_4.8.7 |
| mercurycom | mr816 | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately restrict LAN access to the Mercury MR816v2 router's management interface, ensure that only trusted administrators can access it, and avoid submitting untrusted hostnames to the router. Additionally, consider updating or patching the router firmware if an update is available from the vendor that addresses this XSS vulnerability. Use stronger authentication methods to protect the management interface and isolate session materials to prevent session exfiltration.
Can you explain this vulnerability to me?
This vulnerability is a stored Cross Site Scripting (XSS) issue in the Mercury MR816v2 router's management interface. A remote attacker on the local network can inject malicious JavaScript by submitting a crafted hostname. This script is stored and later executed in the administrator's browser when the interface displays the hostname, such as after a DHCP release or renew. The router's weak authentication and poor session protection allow the attacker to steal the admin session and perform administrative actions.
How can this vulnerability impact me? :
The vulnerability can allow an attacker on the LAN to hijack the administrator's session, execute arbitrary administrative commands on the router, and potentially take full control of the device. This can lead to unauthorized configuration changes, network disruption, and exposure of sensitive network information.