CVE-2025-41367: IDF and ZLF Stored XSS Vulnerability

CVE-2025-41367 Overview

CVE-2025-41367 is a stored Cross-Site Scripting (XSS) vulnerability affecting ZIV's IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04 industrial control products. An authenticated attacker with permissions above the view level can store a malicious JavaScript payload in the device. The payload executes in the browser context of any subsequent user who views the affected page. The weakness is tracked under CWE-79 and was published to the National Vulnerability Database on June 6, 2025.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the management interface, enabling session abuse, unauthorized actions, and lateral movement against operators of industrial IDF and ZLF devices.

Affected Products

ZIV IDF v0.10.0-0C03-03
ZIV ZLF v0.10.0-0C03-04
Industrial control deployments using the affected firmware versions

Discovery Timeline

2025-06-06 - CVE-2025-41367 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41367

Vulnerability Analysis

The flaw is a stored XSS in the web management interface of the IDF and ZLF products. The application accepts input from authenticated users and persists it without proper output encoding or input sanitization. When another user loads the affected view, the stored payload executes in the context of the victim's browser session.

Exploitation requires valid credentials and a role that exceeds view-only permission, which narrows the attacker population to insiders or operators whose accounts have been compromised. However, in operational technology environments, session hijacking of an engineer or administrator account can translate directly into unauthorized configuration changes on protection and control equipment.

Root Cause

The root cause is missing neutralization of user-supplied input before it is rendered in the web interface, consistent with CWE-79. The affected fields store attacker-controlled HTML or JavaScript and later reflect it to other authenticated users without contextual escaping.

Attack Vector

The attack vector is network-based through the device's web interface. The attacker authenticates with elevated privileges, submits a crafted payload through a vulnerable input field, and waits for a privileged user to visit the affected page. User interaction is required for the payload to trigger. See the INCIBE Security Notice on Vulnerabilities for additional vendor-coordinated details.

No verified public proof-of-concept code is available for this CVE. The vulnerability mechanism is described in prose above rather than illustrated with synthetic code.

Detection Methods for CVE-2025-41367

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in configuration fields of the IDF or ZLF web interface.
Browser requests originating from the device management console to unknown external hosts, which may indicate payload callbacks.
Audit log entries showing configuration edits by accounts that typically do not modify those fields.

Detection Strategies

Review persisted form fields in the IDF and ZLF management interface for HTML or JavaScript syntax that should not appear in configuration data.
Correlate authenticated session activity with outbound HTTP requests from operator workstations to spot payload beaconing.
Inspect browser developer tools or proxy captures during administrative sessions to identify scripts loaded from unexpected sources.

Monitoring Recommendations

Enable and centralize audit logs from the affected devices and forward them to a SIEM for correlation with network telemetry.
Monitor privileged account usage on the device, including login times, source IPs, and configuration change frequency.
Alert on changes to fields that should remain static between maintenance windows.

How to Mitigate CVE-2025-41367

Immediate Actions Required

Restrict access to the IDF and ZLF management interface to a dedicated management network or jump host.
Reduce the number of accounts holding permissions above view-only to the minimum required for operations.
Audit stored configuration fields for existing malicious payloads and sanitize or restore from a known-good backup.

Patch Information

Refer to the INCIBE Security Notice on Vulnerabilities for coordinated vendor guidance and firmware remediation details. Apply the vendor-supplied firmware update for IDF and ZLF as soon as it is available for your deployment.

Workarounds

Enforce network segmentation so the device web interface is unreachable from general-purpose user networks.
Require privileged users to administer the devices from hardened workstations with up-to-date browsers and script-blocking extensions where feasible.
Rotate credentials for accounts with configuration privileges and enforce strong, unique passwords.

bash

# Example: restrict management interface access with host-based firewall rules
# Replace 10.10.20.0/24 with your authorized management network
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP