CVE-2025-50740: XSS

Published Aug 6, 2025

Updated

AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web interface /ac/config allows HTML/JS code to be executed via a crafted network SSID.

Affected Software

1 affected component

Arduino AutoConnect

Event History

Aug 6, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-50740?

CVE-2025-50740 is classified as a high severity vulnerability due to its potential to allow cross site scripting (XSS) attacks.

How do I fix CVE-2025-50740?

To fix CVE-2025-50740, update the AutoConnect library to a version that addresses this XSS vulnerability, or implement input validation for network SSIDs.

What types of attacks can CVE-2025-50740 lead to?

CVE-2025-50740 can lead to cross site scripting attacks, which may enable attackers to execute malicious scripts in the context of the user's session.

What versions of AutoConnect are affected by CVE-2025-50740?

CVE-2025-50740 affects AutoConnect version 1.4.2 and possibly earlier versions.

Where does CVE-2025-50740 apply in the AutoConnect library?

CVE-2025-50740 applies specifically to the AutoConnect web interface at the /_ac/config endpoint.