CVE-2025-41367: medium-severity vulnerability in ZIV IDF and ZLF
Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.4%
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
ZIV · IDF and ZLFRelated CVEs — ZIV IDF and ZLF
In the same product, most dangerous first.
CVE-2025-41360HIGHUncontrolled resource consumption vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-41362MEDIUMCode injection vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-41365MEDIUMCode injection vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-41364MEDIUMStored Cross-Site Scripting (XSS) vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-41366MEDIUMCORS vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-41363MEDIUMCORS vulnerability in IDF and ZLFEPSS 0.3%