CVE-2025-41364: IDF and ZLF Stored XSS Vulnerability

CVE-2025-41364 Overview

CVE-2025-41364 is a stored Cross-Site Scripting (XSS) vulnerability affecting ZIV's IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04 products. An authenticated attacker can store a malicious JavaScript payload in the device, which executes in the browser of any subsequent user who views the affected interface. Exploitation requires authentication and the ability to run commands available to accounts with view permission, lowering the barrier compared to admin-only flaws. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated low-privilege user can inject persistent JavaScript that executes in the browser of other users interacting with the device's web interface, enabling session theft, action forgery, and pivoting inside operational technology (OT) environments.

Affected Products

ZIV IDF v0.10.0-0C03-03
ZIV ZLF v0.10.0-0C03-04
Deployments exposing the affected device web interfaces to authenticated operators

Discovery Timeline

2025-06-06 - CVE-2025-41364 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41364

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the web management interface of the ZIV IDF and ZLF devices. Input supplied through authenticated commands is persisted by the device without sufficient output encoding or sanitization. When another user later renders the affected view, the browser interprets the stored payload as executable JavaScript.

Because the attack payload is persistent, it triggers whenever a legitimate user opens the affected page. This turns a single injection into a durable foothold within the management plane. In operational technology environments, that foothold can be leveraged to escalate privileges by targeting administrators who visit the poisoned view. Details are documented in the INCIBE security notice covering multiple vulnerabilities in ZIV IDF and ZLF products.

Root Cause

The root cause is improper neutralization of user-controlled input rendered back into HTML responses. Fields updated through authenticated commands accessible to view-permission accounts are stored verbatim and reflected inside the interface without contextual output encoding, matching the CWE-79 pattern.

Attack Vector

The attack is remote and network-based against the device's HTTP interface. The attacker must first authenticate. Using a low-privilege account with view rights, the attacker executes commands that persist attacker-controlled strings. Any subsequent authenticated user viewing that data triggers execution of the payload in their session context. User interaction from the victim is required to render the malicious content.

No verified public exploit or proof-of-concept code has been published for CVE-2025-41364. See the INCIBE advisory for vendor-coordinated technical detail.

Detection Methods for CVE-2025-41364

Indicators of Compromise

Stored fields on IDF or ZLF devices containing HTML or script tokens such as <script, onerror=, onload=, or javascript: URIs.
Unexpected outbound HTTP requests from operator workstations to attacker-controlled hosts shortly after opening the device management UI.
Audit-log entries showing view-permission accounts issuing configuration or labeling commands that write text fields outside their normal workflow.

Detection Strategies

Inspect persistent configuration exports and API responses from IDF and ZLF devices for HTML control characters and script-like patterns in fields expected to be plaintext.
Deploy a Content Security Policy (CSP) reporting endpoint on operator browsers to capture inline script violations originating from the device UI.
Correlate authentication events for low-privilege accounts with configuration-write commands to identify accounts abusing view-tier permissions.

Monitoring Recommendations

Forward device web-server and audit logs to a centralized analytics platform and alert on write operations from view-only accounts.
Monitor operator workstation browsers for anomalous JavaScript execution or unexpected DOM modifications while interacting with the device UI.
Track network egress from the OT management VLAN toward unclassified destinations, which may indicate token exfiltration via XSS.

How to Mitigate CVE-2025-41364

Immediate Actions Required

Restrict access to the IDF and ZLF management interfaces to a dedicated administration network with strict allow-listing.
Review all accounts with view permission and remove or disable any that are not strictly required for operations.
Audit stored configuration and label fields for existing script payloads and sanitize any suspicious entries before further use.
Enforce unique, strong credentials and multi-factor authentication where supported to raise the cost of the required initial authentication step.

Patch Information

Refer to the INCIBE security notice on ZIV IDF and ZLF vulnerabilities for the vendor's coordinated remediation guidance and updated firmware releases. Apply the vendor-supplied firmware update for IDF and ZLF as soon as it is available in your environment's change window.

Workarounds

Place the device management interfaces behind a jump host or bastion that terminates browser sessions and disallows arbitrary script execution.
Configure operator browsers with strict Content Security Policy headers via a reverse proxy to block inline scripts served by the device UI.
Segment OT management traffic from corporate networks and require VPN plus MFA for any operator session touching the affected devices.
Rotate credentials and session tokens for any user who may have viewed a potentially poisoned page.

bash

# Example: restrict access to the device management UI at the network edge
# (replace interface, subnet, and device IP with values from your environment)
iptables -A FORWARD -s 10.10.20.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP