CVE-2025-8153

State: Published
Severity: 5.1 Medium
Published: Sep 17, 2025
Updated: Sep 17, 2025
Reserved: Jul 25, 2025

Description

Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	NEC

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
UNIVERGE IXNEC Corporation	from Ver.9.5 to Ver.10.7Affected
UNIVERGE IXNEC Corporation	from Ver.10.8.21 to Ver.10.8.36Affected
UNIVERGE IXNEC Corporation	from Ver.10.9.11 to Ver.10.9.24Affected
UNIVERGE IXNEC Corporation	from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6Affected
UNIVERGE IX-R/IX-VNEC Corporation	Ver1.3.16, Ver1.3.21Affected

References

https://jpn.nec.com/security-info/secinfo/nv25-005_en.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.