VulnerabilityAnalyzed
CVE-2025-48470
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft,…
MEDIUM 4.1EPSS 0.17%
Does this matter?
Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.
Description
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.
- CVSS 3.1
- 4.1 MEDIUMCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
- EPSS
- 0.17% probability · 7th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- advantech/wise-4010lan firmware · advantech/wise-4050lan firmware · advantech/wise-4060lan firmware
- Source
- 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
References
- https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.