CVE-2025-61305: Mercury Managed Print Services XSS Flaw

CVE-2025-61305 Overview

CVE-2025-61305 is a reflected cross-site scripting (XSS) vulnerability in the dfm-menu_firmware.php component of docuForm GmbH Mecury Managed Print Services version 11.11c. The flaw allows attackers to execute arbitrary JavaScript in a victim's browser by injecting crafted payloads into an unfiltered variable value. Exploitation requires user interaction, typically clicking a malicious link. The vulnerability is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated user's session, enabling session hijacking, credential theft, and unauthorized actions against the print management interface.

Affected Products

docuForm GmbH Mecury Managed Print Services v11.11c
The dfm-menu_firmware.php component
docuForm print management web interface

Discovery Timeline

2026-05-11 - CVE-2025-61305 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-61305

Vulnerability Analysis

The vulnerability resides in the dfm-menu_firmware.php component of the Mecury Managed Print Services web application. The component reflects user-supplied input into the HTTP response without proper output encoding or input sanitization. An attacker can craft a URL containing JavaScript payloads in a vulnerable parameter and deliver it to a target user. When the user loads the URL, the injected script executes in the browser under the origin of the print management application.

Reflected XSS in administrative interfaces such as print management consoles is particularly impactful. The injected script runs with the privileges of the authenticated user, allowing attackers to perform actions such as modifying firmware configuration, exfiltrating session tokens, or pivoting to other resources accessible from the user's browser context.

Root Cause

The root cause is the absence of input validation and output encoding on a variable processed by dfm-menu_firmware.php. The application echoes attacker-controlled data into the HTML response without applying contextual encoding, mapping directly to [CWE-79].

Attack Vector

Exploitation is remote and requires user interaction. The attacker constructs a URL pointing to the vulnerable dfm-menu_firmware.php endpoint with a malicious payload in the unfiltered parameter. Delivery typically occurs through phishing emails, instant messages, or links from attacker-controlled sites. When an authenticated administrator clicks the link, the payload executes in the context of the print management application. Refer to the GitHub Gist by ZeroBreach for technical details of the proof of concept.

Detection Methods for CVE-2025-61305

Indicators of Compromise

HTTP GET requests to dfm-menu_firmware.php containing URL-encoded <script>, javascript:, or event handler payloads such as onerror= and onload=
Web server access logs showing long query strings with HTML special characters targeting Mecury Managed Print Services hosts
Referer headers pointing to external domains immediately preceding requests to the print management interface

Detection Strategies

Deploy web application firewall (WAF) rules to inspect query parameters sent to dfm-menu_firmware.php for XSS signatures
Correlate browser-side Content Security Policy (CSP) violation reports with access logs on the print management server
Hunt for outbound requests from administrator workstations to unfamiliar domains shortly after accessing the print management URL

Monitoring Recommendations

Enable verbose request logging on the docuForm web interface and forward logs to a centralized SIEM for analysis
Monitor authenticated administrator sessions for anomalous behavior such as unexpected configuration changes or firmware actions
Alert on outbound HTTP requests from the print management server containing session cookies in non-standard headers

How to Mitigate CVE-2025-61305

Immediate Actions Required

Restrict access to the Mecury Managed Print Services web interface to trusted management networks using firewall ACLs or VPN gating
Instruct administrators to avoid clicking unverified links while authenticated to the print management console
Deploy WAF rules that block requests to dfm-menu_firmware.php containing HTML tags, JavaScript URIs, or event handler attributes

Patch Information

No vendor patch has been confirmed in the published advisory at the time of writing. Contact docuForm through the Docuform Security Information site to confirm patch availability for Mecury Managed Print Services v11.11c. Apply vendor-supplied updates as soon as they become available.

Workarounds

Place the print management interface behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts
Require administrators to use a dedicated browser profile with no saved credentials when accessing the management interface
Implement short session timeouts and require re-authentication for sensitive operations such as firmware management

bash

# Example nginx reverse proxy CSP header to limit XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";