CVE-2025-41365: IDF and ZLF Cross-Site Scripting Vulnerability

CVE-2025-41365 Overview

CVE-2025-41365 is a code injection vulnerability [CWE-94] affecting Zivs IDF version v0.10.0-0C03-03 and ZLF version v0.10.0-0C03-04. The flaw allows an authenticated attacker with elevated permissions to store a malicious payload that executes in the browser of any user who later views the affected content. The issue was published to the National Vulnerability Database on 2025-06-06 and is tracked under INCIBE CERT's advisory covering multiple vulnerabilities in Ziv's industrial products.

Critical Impact
An authenticated attacker holding permissions above the view role can store a persistent payload that runs in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the device management interface.

Affected Products

Ziv IDF version v0.10.0-0C03-03
Ziv ZLF version v0.10.0-0C03-04
Industrial control system (ICS) devices running the affected firmware builds

Discovery Timeline

2025-06-06 - CVE-2025-41365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41365

Vulnerability Analysis

The vulnerability resides in the web management interface of the IDF and ZLF products. Input supplied through privileged commands is stored by the device without sufficient sanitization or output encoding. When another user accesses the view containing the stored data, the payload executes in the browser context of the affected device's management UI. This behavior is characteristic of a stored code injection flaw classified under [CWE-94] (Improper Control of Generation of Code).

Because the vulnerable commands require permissions higher than the view role, exploitation is restricted to authenticated users with administrative or operator-level access. The impact extends to any user who subsequently visits the affected interface page, including users holding higher privileges than the attacker.

Root Cause

The root cause is improper neutralization of user-controlled input in device commands that persist data to the management interface. The application fails to validate or encode input before storing it and fails to encode it when rendering the stored content back to the browser. This allows attacker-controlled script to be treated as executable content.

Attack Vector

An authenticated attacker with elevated privileges issues one of the vulnerable commands over the network and embeds a malicious payload in the input. The device stores the payload. When a legitimate user navigates to the view that renders the stored data, the payload executes in that user's browser session. See the INCIBE CERT Vulnerability Notice for coordinated advisory details.

Detection Methods for CVE-2025-41365

Indicators of Compromise

Unexpected script tags, HTML entities, or JavaScript constructs stored in device configuration fields exposed through the IDF or ZLF web interface.
Audit log entries showing elevated-permission commands issued from unusual source addresses or outside normal maintenance windows.
Browser-side anomalies such as unexpected redirects, session token exfiltration attempts, or outbound requests originating from the device management UI.

Detection Strategies

Inspect stored configuration values and command parameters for HTML or JavaScript markup that should not appear in operational fields.
Correlate authenticated administrative sessions with subsequent viewer sessions that trigger browser-side errors or unexpected network callbacks.
Enable verbose audit logging on the device and forward events to a centralized log platform for review of privileged command activity.

Monitoring Recommendations

Monitor privileged account usage on IDF and ZLF devices and alert on commands executed by non-administrator accounts that have been granted elevated roles.
Baseline normal content stored in management interface fields and flag deviations containing scripting syntax.
Capture egress traffic from workstations used to administer ICS devices and alert on outbound connections to unfamiliar domains following interface access.

How to Mitigate CVE-2025-41365

Immediate Actions Required

Restrict access to the IDF and ZLF management interface to a dedicated, isolated management network segment.
Audit all accounts holding permissions above the view role and revoke privileges that are not required for daily operations.
Review stored configuration fields and remove any suspicious HTML or JavaScript content.

Patch Information

Refer to the INCIBE CERT Vulnerability Notice for coordinated vendor remediation guidance. Operators should contact Ziv directly to obtain firmware updates addressing the affected IDF and ZLF versions and apply them following standard ICS change-control procedures.

Workarounds

Enforce strict role-based access control and limit elevated roles to a minimal set of trusted operators.
Require administrators to access the device interface only from hardened management workstations with restricted browser extensions.
Place the device behind a reverse proxy or web application firewall capable of filtering script content in request parameters until a vendor patch is available.
Disable or avoid the vulnerable commands identified in the INCIBE advisory until updated firmware is deployed.

bash

# Example network segmentation using iptables to restrict device management access
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP