CVE-2025-63354: Hitrontech Hi3120 Firmware XSS Vulnerability

CVE-2025-63354 Overview

CVE-2025-63354 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Hitron HI3120 router running firmware version 7.2.4.5.2b1. The vulnerability exists in the Parental Control feature of the device's web management interface, specifically when creating a new filter. Due to improper input handling, an attacker can inject and execute arbitrary JavaScript code that persists in the device's configuration.

Critical Impact

Attackers with local access and low privileges can inject malicious JavaScript into the Parental Control filter settings, which will execute in the context of other users accessing the management interface, potentially leading to session hijacking, credential theft, or unauthorized configuration changes.

Affected Products

• Hitrontech HI3120 Firmware version 7.2.4.5.2b1
• Hitrontech HI3120 Hardware

Discovery Timeline

• 2026-02-09 - CVE CVE-2025-63354 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2025-63354

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) resides in the Parental Control functionality of the Hitron HI3120 router's administrative interface. When a user creates a new content filter within the Parental Control settings, the application fails to properly sanitize or validate user-supplied input before storing it in the device configuration and subsequently rendering it back to the browser.

The attack requires local network access and low-level privileges to access the router's management interface. User interaction is necessary for exploitation, as the malicious payload executes when another authenticated user views the affected Parental Control settings page. The scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component itself, potentially impacting the security context of other users' browser sessions.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the Parental Control filter creation functionality. The firmware does not adequately sanitize user-provided input when storing filter configurations, nor does it properly encode output when rendering these values back to the administrative interface. This allows malicious JavaScript to be stored in the device configuration and executed whenever the affected page is loaded.

Attack Vector

The attack vector for CVE-2025-63354 requires local network access to the router's web management interface. An attacker with valid credentials and low-level privileges navigates to the Parental Control section and creates a new filter. Instead of providing legitimate filter criteria, the attacker injects JavaScript code into the filter name or related input fields. This malicious code is stored persistently in the device configuration.

When another administrator or user with higher privileges accesses the Parental Control settings page, the stored JavaScript payload executes in their browser context. This can lead to session cookie theft, unauthorized actions performed on behalf of the victim user, or extraction of sensitive configuration data from the router interface.

For technical details on this vulnerability, see the Proof of Concept Repository published by the security researcher.

Detection Methods for CVE-2025-63354

Indicators of Compromise

• Unexpected or suspicious entries in Parental Control filter configurations containing JavaScript syntax such as <script>, onerror=, onload=, or similar event handlers
• Unusual network traffic from the router's management interface to external domains that may indicate data exfiltration
• Anomalous session activity or unauthorized configuration changes following administrator access to Parental Control settings

Detection Strategies

• Implement web application firewall (WAF) rules to detect common XSS patterns in HTTP requests destined for the router management interface
• Monitor HTTP traffic for encoded JavaScript payloads targeting the Parental Control functionality
• Review router configuration exports for suspicious entries containing script tags or JavaScript event handlers
• Enable logging on the router management interface and analyze logs for unusual POST requests to filter creation endpoints

Monitoring Recommendations

• Regularly audit Parental Control filter configurations for unauthorized or suspicious entries
• Implement network segmentation to restrict access to router management interfaces from trusted administrative workstations only
• Monitor for session anomalies that could indicate session hijacking following XSS exploitation
• Set up alerts for configuration changes to the Parental Control feature outside of authorized change windows

How to Mitigate CVE-2025-63354

Immediate Actions Required

• Restrict access to the router's web management interface to trusted administrative IP addresses only
• Review and audit all existing Parental Control filter entries for potentially malicious content
• Consider disabling the Parental Control feature if not actively used until a patch is available
• Ensure administrative sessions are conducted over HTTPS if supported by the device
• Use dedicated browser profiles or private browsing modes when accessing the router management interface to limit potential impact of XSS attacks

Patch Information

At the time of publication, no vendor advisory or official patch has been released by Hitrontech for this vulnerability. Users are advised to monitor the vendor's support channels for firmware updates addressing this issue. The vulnerability has been publicly documented in a GitHub repository containing proof-of-concept details.

Workarounds

• Implement network-level access controls to limit who can access the router's management interface
• Configure firewall rules to block management interface access from untrusted network segments
• Use a dedicated management VLAN for router administration
• Regularly back up router configurations and compare against known-good baselines to detect unauthorized modifications
• Consider deploying a reverse proxy with XSS filtering capabilities in front of the management interface if feasible in your environment

# Example: Restrict management interface access via iptables on upstream firewall
# Replace 192.168.1.0/24 with your trusted admin network
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 443 -j DROP