CVE-2025-68395: Stored XSS in Protectel
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PROTECTELMAJto a version that resolves this vulnerability.Fixed in 6.5.19 - Upgrade
Upgrade
BDFto a version that resolves this vulnerability.Fixed in 6.4.67
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the note editor module in ARKETEAM Protectel PROTECTELMAJ and BDF. Fixed versions are PROTECTELMAJ v6.5.19 and BDF v6.4.67.
What does an attacker need to exploit this issue?
A low-privileged attacker needs the ability to create or modify notes in the vulnerable note editor. They can inject arbitrary HTML and JavaScript that executes when another user visits the module containing the note.
Is user interaction required for exploitation?
Yes. The injected content is rendered and executed when a user visits the affected module, so a victim must access the page or module where the malicious note is displayed.