CVE-2025-8153

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8153", "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282", "state": "PUBLISHED", "assignerShortName": "NEC", "dateReserved": "2025-07-25T01:38:55.766Z", "datePublished": "2025-09-17T02:10:09.645Z", "dateUpdated": "2025-09-17T13:45:14.075Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.9.5 to Ver.10.7"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.10.8.21 to Ver.10.8.36"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.10.9.11 to Ver.10.9.24"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX-R/IX-V", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "Ver1.3.16, Ver1.3.21"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "RyotaK of GMO Flatt Security Inc."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser."}], "value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser."}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282", "shortName": "NEC", "dateUpdated": "2025-09-17T02:10:50.272Z"}, "references": [{"url": "https://jpn.nec.com/security-info/secinfo/nv25-005_en.html"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-17T13:44:45.472287Z", "id": "CVE-2025-8153", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-17T13:45:14.075Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8153", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-17T13:44:45.472287Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-17T13:45:05.822Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "RyotaK of GMO Flatt Security Inc."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NEC Corporation", "product": "UNIVERGE IX", "versions": [{"status": "affected", "version": "from Ver.9.5 to Ver.10.7"}], "defaultStatus": "unknown"}, {"vendor": "NEC Corporation", "product": "UNIVERGE IX", "versions": [{"status": "affected", "version": "from Ver.10.8.21 to Ver.10.8.36"}], "defaultStatus": "unknown"}, {"vendor": "NEC Corporation", "product": "UNIVERGE IX", "versions": [{"status": "affected", "version": "from Ver.10.9.11 to Ver.10.9.24"}], "defaultStatus": "unknown"}, {"vendor": "NEC Corporation", "product": "UNIVERGE IX", "versions": [{"status": "affected", "version": "from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6"}], "defaultStatus": "unknown"}, {"vendor": "NEC Corporation", "product": "UNIVERGE IX-R/IX-V", "versions": [{"status": "affected", "version": "Ver1.3.16, Ver1.3.21"}], "defaultStatus": "unknown"}], "references": [{"url": "https://jpn.nec.com/security-info/secinfo/nv25-005_en.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.", "supportingMedia": [{"type": "text/html", "value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282", "shortName": "NEC", "dateUpdated": "2025-09-17T02:10:50.272Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8153", "state": "PUBLISHED", "dateUpdated": "2025-09-17T13:45:14.075Z", "dateReserved": "2025-07-25T01:38:55.766Z", "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282", "datePublished": "2025-09-17T02:10:09.645Z", "assignerShortName": "NEC"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.9.5 to Ver.10.7"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.10.8.21 to Ver.10.8.36"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.10.9.11 to Ver.10.9.24"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6"}]}, {"defaultStatus": "unknown", "product": "UNIVERGE IX-R/IX-V", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "Ver1.3.16, Ver1.3.21"}]}], "source": "psirt-info@cyber.jp.nec.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting en NEC Corporation UNIVERGE IX desde la Ver.9.5 hasta la Ver.10.7, desde la Ver.10.8.21 hasta la Ver.10.8.36, desde la Ver.10.9.11 hasta la Ver.10.9.24, desde la Ver.10.10.21 hasta la Ver.10.10.31, Ver.10.11.6 y UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 permite a un atacante inyectar scripts arbitrarios que pueden ser ejecutados en el navegador del usuario."}], "id": "CVE-2025-8153", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt-info@cyber.jp.nec.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8153", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-17T13:44:45.472287Z", "version": "2.0.3"}}]}, "published": "2025-09-17T02:15:33.310", "references": [{"source": "psirt-info@cyber.jp.nec.com", "url": "https://jpn.nec.com/security-info/secinfo/nv25-005_en.html"}], "sourceIdentifier": "psirt-info@cyber.jp.nec.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt-info@cyber.jp.nec.com", "type": "Secondary"}]}

{}

{"created": "2025-09-17T10:52:00.156013+00:00", "updated": "2025-09-17T10:52:00.156072+00:00", "vendors": ["nec_corporation", "nec_corporation$PRODUCT$univerge_1x", "nec_corporation$PRODUCT$univerge_1x-r\\/ix-v"]}