CVE-2025-64730: Sony SNC-CX600W Firmware XSS Vulnerability

CVE-2025-64730 Overview

CVE-2025-64730 is a cross-site scripting (XSS) vulnerability affecting all firmware versions of the Sony SNC-CX600W network camera. An attacker positioned on an adjacent network can inject arbitrary script content that executes in the browser of a user who accesses the affected product. The weakness is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation lets attackers run script in the authenticated user's browser session, enabling theft of session data, unauthorized configuration changes, or pivoting to further attacks against the camera management interface.

Critical Impact
An adjacent-network attacker can execute arbitrary JavaScript in the browser of any user accessing the SNC-CX600W web interface, undermining the confidentiality and integrity of the management session.

Affected Products

Sony SNC-CX600W (hardware) — all versions
Sony SNC-CX600W firmware — all versions
Deployments using the camera's built-in web management interface

Discovery Timeline

2025-11-25 - CVE-2025-64730 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64730

Vulnerability Analysis

The SNC-CX600W web management interface fails to properly neutralize user-supplied input before reflecting or storing it in HTML output. When a user with browser access loads the affected page, the injected payload is parsed as script by the browser and executes in the security context of the camera's web origin.

Because the flaw resides in the embedded web application shipped with all firmware releases, every deployed unit is affected until Sony publishes updated firmware. Exploitation requires user interaction (UI:A) — the victim must load an attacker-influenced page or resource served by the camera.

The attack vector is limited to the adjacent network, meaning the attacker must be on the same broadcast domain, VLAN, or logical network segment as the camera. This constrains remote internet exploitation but is realistic for compromised internal hosts, guest Wi-Fi bridging, or physical-proximity attackers on video surveillance networks.

Root Cause

The root cause is insufficient output encoding and input validation within the camera's HTTP management interface. HTML metacharacters supplied by an attacker are rendered without contextual escaping, allowing <script> tags, event handler attributes, or javascript: URIs to reach the DOM of a legitimate user session.

Attack Vector

An attacker on an adjacent network delivers a crafted request or persuades a legitimate operator to visit a URL containing the payload. When the browser renders the response from the camera, the injected script runs with access to cookies, tokens, and any actions available to the logged-in user. Sony has not published detailed technical write-ups; refer to the JVN #JVN75140384 Advisory for coordinated disclosure information.

No public proof-of-concept exploit code is available for CVE-2025-64730 at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-64730

Indicators of Compromise

HTTP requests to the SNC-CX600W management interface containing HTML or JavaScript metacharacters such as <script>, onerror=, or javascript: in query strings, POST bodies, or headers.
Unexpected outbound connections from operator workstations immediately after browsing to the camera's IP address.
Camera configuration changes (users, network settings, streaming endpoints) not tied to a legitimate administrator action.

Detection Strategies

Inspect web proxy and NDR logs for reflected script payloads in traffic destined to camera management IPs on the video surveillance VLAN.
Alert on browser-based script execution originating from private IP ranges assigned to IoT and camera segments, which typically should not serve active web content to operator endpoints.
Correlate operator workstation process telemetry with visits to camera web UIs to identify anomalous child processes or credential access following the visit.

Monitoring Recommendations

Continuously log HTTP requests to the SNC-CX600W interface at the network gateway and retain payload bodies for retrospective XSS hunting.
Monitor administrator account activity on the camera for out-of-hours or unattributed configuration changes.
Track firmware version inventories for the SNC-CX600W fleet and flag any device that has not been updated once a fix is released.

How to Mitigate CVE-2025-64730

Immediate Actions Required

Restrict access to the SNC-CX600W management interface to a dedicated administrative VLAN and a small set of jump hosts.
Require operators to access the camera web UI only from hardened, dedicated browsers that do not share session state with general-purpose browsing.
Rotate any credentials that were used on the camera web UI from potentially exposed operator workstations.
Consult the Sony Camera Support Page for firmware release notifications.

Patch Information

At the time of publication, no vendor-supplied patch reference is listed in the NVD entry for CVE-2025-64730. Monitor the JVN #JVN75140384 Advisory and the Sony support page for firmware updates addressing the XSS flaw and apply them across the affected fleet as soon as they are available.

Workarounds

Place the SNC-CX600W on an isolated network segment with no route to general user workstations or the internet.
Enforce firewall rules that only permit management access from designated administrator IP addresses.
Disable or reduce use of the web management interface where possible, using the camera's native protocols for routine operations.
Deploy browser-side Content Security Policy enforcement via enterprise browser policies to reduce the impact of reflected script when operators must access the UI.

bash

# Example: restrict SNC-CX600W management access to an admin subnet using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d 10.20.30.40 --dport 80  -s 10.10.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.20.30.40 --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.20.30.40 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 10.20.30.40 --dport 443 -j DROP