CVE-2025-2212 Overview
CVE-2025-2212 is a stored cross-site scripting (XSS) vulnerability affecting the Castlenet CBW383G2N router firmware up to build 20250301. The flaw resides in the /RgSwInfo.asp administrative page, where the Description parameter fails to sanitize HTML input. An authenticated attacker can inject payloads such as <img/src/onerror=prompt(8)> that execute in the browser context of any user viewing the affected page. The issue is tracked as CWE-79 and can be triggered remotely over the network. The vendor was contacted about this disclosure but did not respond.
Critical Impact
Successful exploitation allows an attacker to run arbitrary JavaScript in an administrator's browser session, enabling credential theft, configuration tampering, or session hijacking against the router management interface.
Affected Products
- Castlenet CBW383G2N router (hardware)
- Castlenet CBW383G2N firmware up to 20250301
- Administrative web interface component /RgSwInfo.asp
Discovery Timeline
- 2025-03-11 - CVE-2025-2212 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2212
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the router's web management interface. When an authenticated user submits data through the Description field handled by /RgSwInfo.asp, the application persists the input and later renders it into an HTML response without proper encoding. Any HTML or JavaScript in the field is interpreted by the victim's browser.
An attacker with valid administrative credentials, or one who tricks an administrator into submitting a crafted request, can plant a persistent payload. The public disclosure notes that other parameters on the same endpoint may also be affected, expanding the attack surface across the management console.
Because the exploit has been publicly disclosed and no vendor patch is available, exposed management interfaces remain at ongoing risk. The advisory records exploitation as feasible remotely, though user interaction is required to trigger the injected payload.
Root Cause
The root cause is missing output encoding of user-controlled input rendered by the RgSwInfo.asp handler. Input passed through the Description parameter is written into the HTML document without contextual escaping of characters such as <, >, and ", allowing HTML tags and event handlers like onerror to execute.
Attack Vector
Exploitation requires network access to the router's HTTP management interface and privileged credentials to submit the malicious Description value. The payload executes when any subsequent user, typically an administrator, loads the affected page. A representative payload from the public disclosure is <img/src/onerror=prompt(8)>, which triggers on image load failure. No verified proof-of-concept code has been published beyond the disclosed payload string.
Detection Methods for CVE-2025-2212
Indicators of Compromise
- HTTP POST or GET requests to /RgSwInfo.asp containing HTML tags, on* event handlers, or <script> fragments in the Description parameter.
- Rendered management pages that contain unexpected <img>, <svg>, or <script> elements within device description fields.
- Administrator browser sessions producing outbound requests to unfamiliar hosts immediately after loading router administration pages.
Detection Strategies
- Inspect proxy or firewall logs for requests to the CBW383G2N management URL containing angle brackets, javascript:, or event handler keywords.
- Deploy web application firewall rules that flag XSS payload patterns against router management endpoints on internal networks.
- Compare stored router configuration values against known-good baselines to identify tampered Description fields.
Monitoring Recommendations
- Log administrative access to the CBW383G2N interface and alert on configuration changes originating from unusual source addresses.
- Restrict router management traffic to a dedicated management VLAN and monitor east-west flows toward that segment.
- Track browser telemetry from administrator workstations for script execution or credential access following router interface visits.
How to Mitigate CVE-2025-2212
Immediate Actions Required
- Restrict access to the CBW383G2N web management interface to trusted administrative networks only, blocking exposure to untrusted LAN segments and the internet.
- Rotate administrative credentials and audit existing Description values across router pages for injected HTML or JavaScript.
- Instruct administrators to use dedicated, hardened browsers or management workstations when accessing the device.
Patch Information
No vendor patch is currently available. According to the public disclosure referenced by VulDB ID #299283, the vendor was contacted but did not respond. Monitor Castlenet communications for future firmware updates addressing the /RgSwInfo.asp input handling.
Workarounds
- Disable remote management on the WAN interface and require VPN access for administration.
- Enforce strong, unique administrative passwords and enable any available session timeout settings.
- Where feasible, place the CBW383G2N behind a reverse proxy or web application firewall that filters XSS payloads targeting management URLs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
