CVE-2025-6235: ExtremeControl (NAC) 'onmouseover' XSS
In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ExtremeControl (NAC)to a version that resolves this vulnerability.Fixed in 25.5.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6235?
CVE-2025-6235 has been classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-6235?
To fix CVE-2025-6235, upgrade to ExtremeControl version 25.5.12 or later, which addresses the XSS vulnerability.
What causes CVE-2025-6235?
CVE-2025-6235 is caused by improper handling of user-supplied input within HTML attributes in the login interface.
What are the potential impacts of CVE-2025-6235?
The potential impacts of CVE-2025-6235 include the possibility for attackers to execute malicious scripts in the context of a user session.
Is my version of ExtremeControl vulnerable to CVE-2025-6235?
If you are using ExtremeControl version prior to 25.5.12, your application is vulnerable to CVE-2025-6235.