desknet's NEO & Web Server Multiple Vulnerabilities Advisory (CVE-2025-24833, XSS, Hardcoded Keys)

Critical Vulnerability Information Vulnerability Overview CVE IDs: CVE-2025-24833, CVE-2025-52583, CVE-2025-54760, CVE-2025-54859, CVE-2025-55072, CVE-2025-58079, CVE-2025-58426 Affected Products: desknet's NEO (V4.0R1.0 to V9.0R2.0), desknet's Web Server Vulnerability Description Stored Cross-Site Scripting (CWE-79): - CVSS v3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:A/N Base Score: 4.8 - CVSS v3.0/AV:N/AC:L/PR:L/UI:R/S:C/L:L/E:H/A:N Base Score: 5.4 - Related CVEs: CVE-2025-24833, CVE-2025-54760, CVE-2025-55072 Reflected Cross-Site Scripting (CWE-79): - CVSS v3.0/AV:N/AC:L/AT:N/PR:L/UI:R/AV:C/AV:N/SC:L/SE:L/I:A/N Base Score: 5.1 - CVSS v3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/E:L/A:N Base Score: 6.1 - Related CVE: CVE-2025-52583 Stored Cross-Site Scripting (CWE-79): - CVSS v3.0/AV:N/AC:L/AT:N/PR:L/UI:R/AV:C/AV:N/SC:L/SE:L/I:A/N Base Score: 4.6 - CVSS v3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/E:L/A:N Base Score: 4.0 - Related CVE: CVE-2025-54859 Improper Protection of Backup Paths in AppSuite (CWE-424): - CVSS v3.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VL:VA/N/SC:N/SE:N/SA:N Base Score: 5.3 - CVSS v3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3 - Related CVE: CVE-2025-58079 Use of Hardcoded Encryption Keys (CWE-321): - CVSS v3.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VL:VA/N/SC:N/SE:N/SA:N Base Score: 5.3 - CVSS v3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3 - Related CVE: CVE-2025-58426 Impact Arbitrary JavaScript code may be executed within users' web browsers. Remote authenticated attackers may create malicious AppSuite applications. Remediation For CVE-2025-24833, CVE-2025-52583, CVE-2025-54760, CVE-2025-54859, CVE-2025-55072, CVE-2025-58079, CVE-2025-58426: Upgrade software to the latest version. For CVE-2025-52583: Discontinue use of desknet's Web Server and switch to IIS. Reporters Shy Adapt of GMO Cybersecurity by Iteara, Inc. Ryo Sato Daisuke Ohana Kentaro Ishii of GMO Cybersecurity by Iteara, Inc.

Goal Reached Thanks to every supporter — we hit 100%!

desknet's NEO & Web Server Multiple Vulnerabilities Advisory (CVE-2025-24833, XSS, Hardcoded Keys)