NEC UNIVERGE IX Series XSS and CLI Injection Vulnerability (CVE-2025-8153)

Key Information Vulnerability Overview Vulnerability ID: NV25-005 CVE ID: CVE-2025-8153 Description: A cross-site scripting (XSS) vulnerability exists in UNIVERGE IX/R/IX-V series routers (CVE-2025-8153). - If a user accesses a specially crafted URL, arbitrary scripts may be executed in the user’s browser. - For UNIVERGE IX series routers, if a user logged into the product management interface sends a specially crafted WebGUI message, arbitrary CLI commands may be executed on the device. Affected Products and Versions UNIVERGE IX Series - All versions from Ver.9.5 to Ver.10.7 - Versions from Ver.10.8.21 to Ver.10.8.36 - Versions from Ver.10.9.11 to Ver.10.9.24 - Versions from Ver.10.10.21 to Ver.10.10.31, and Ver.10.11.6 - Models: IX2105/IX2106/IX2107/IX2207/IX2025/IX2215/IX2235/IX2310/IX3015/IX3110/IX3315 UNIVERGE IX-R/IX-V Series - Versions: Ver1.3.16, Ver1.3.21 - Models: IX-R2520/IX-R2530/IX-R2810-4G/IX-V100 Remediation Update: Please upgrade to the latest version. - UNIVERGE IX Series: Update Link - UNIVERGE IX R/IX V Series: Update Link Temporary Mitigation: If updating is not possible, disable the WebGUI. References CVE-2025-8153: CVE Details UNIVERGE IX Series: Product Details UNIVERGE IX-R/IX-V Series: Product Details Acknowledgments Reporter: Ryotak of GMO Flatt Security Inc. Update Date September 17, 2025 (First Edition)

Goal Reached Thanks to every supporter — we hit 100%!

NEC UNIVERGE IX Series XSS and CLI Injection Vulnerability (CVE-2025-8153)