CVE-2025-14701: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crafty Controllerto a version that resolves this vulnerability.Fixed in 4.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14701?
CVE-2025-14701 has been classified as a moderate-severity vulnerability due to its potential for stored XSS exploitation.
How do I fix CVE-2025-14701?
To fix CVE-2025-14701, ensure that the Server MOTD component properly sanitizes input to prevent injection of malicious scripts.
Who is affected by CVE-2025-14701?
CVE-2025-14701 affects users of Crafty Controller that utilize the Server MOTD feature.
What type of vulnerability is CVE-2025-14701?
CVE-2025-14701 is an input neutralization vulnerability that leads to stored cross-site scripting (XSS).
Can CVE-2025-14701 be exploited remotely?
Yes, CVE-2025-14701 can be exploited remotely by unauthenticated attackers through server MOTD modification.