CVE-2025-65230: Barix Instreamer Firmware XSS Vulnerability

CVE-2025-65230 Overview

CVE-2025-65230 is a stored cross-site scripting (XSS) vulnerability affecting Barix Instreamer audio streaming devices running firmware versions 4.05 and 4.06. The flaw resides in the Web UI Configuration interface, specifically in the Streaming Destination input field. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the device configuration and executes in the browser of any user who views the affected page. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Persistent JavaScript payloads stored in the Streaming Destination field execute in administrator browsers, enabling session hijacking, configuration tampering, and pivoting into the network segment hosting the device.

Affected Products

Barix Instreamer Firmware version 4.05
Barix Instreamer Firmware version 4.06
Barix Instreamer hardware appliance

Discovery Timeline

2025-12-08 - CVE-2025-65230 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65230

Vulnerability Analysis

The Barix Instreamer exposes a web-based configuration interface used to define streaming endpoints for audio distribution. The Streaming Destination input in this Web UI fails to sanitize or encode user-supplied values before storing them and rendering them back to the browser. As a result, an attacker who can authenticate to the device with configuration privileges can inject arbitrary HTML or JavaScript. The payload persists across sessions because it is written to the device configuration store.

When an administrator subsequently loads the configuration page, the injected script executes with the origin of the Instreamer Web UI. This allows the attacker to read session cookies, submit forged configuration changes, or redirect the browser to attacker-controlled infrastructure. Because the scope is marked as changed in the CVSS vector, the impact extends beyond the vulnerable component to other browser-accessible resources under the same origin.

Root Cause

The root cause is missing output encoding and input validation on the Streaming Destination field within the Web UI Configuration handler. The firmware trusts input supplied to configuration endpoints and reflects it into HTML responses without contextual escaping, matching the pattern described in CWE-79.

Attack Vector

Exploitation requires network reachability to the Instreamer Web UI and valid low-privileged credentials, plus user interaction from a victim who loads the affected page. An attacker submits a crafted value to the Streaming Destination configuration field. The payload is written to persistent storage. When an operator or administrator subsequently opens the configuration page, the browser parses the malicious markup and executes the attacker's JavaScript in the context of the Instreamer web session.

A proof-of-concept demonstrating the injection is documented in the public research repository. No exploitation code is reproduced here; consult the researcher's write-up for payload structure.

Detection Methods for CVE-2025-65230

Indicators of Compromise

Unexpected <script>, <img>, or event-handler attributes stored in the Streaming Destination field of the Instreamer configuration.
Outbound HTTP requests from administrator workstations to unfamiliar domains immediately after loading the Instreamer Web UI.
Configuration change events on the Instreamer originating from low-privileged accounts that should not modify streaming endpoints.

Detection Strategies

Review saved configurations on all Barix Instreamer devices for non-URL characters such as angle brackets, quotes, or JavaScript keywords in destination fields.
Correlate web proxy logs with administrator visits to Instreamer management IPs to identify anomalous redirects or beaconing.
Enable browser-side Content Security Policy reporting on management workstations to surface script executions from device management interfaces.

Monitoring Recommendations

Log and alert on all authenticated configuration changes to Barix Instreamer devices, including field-level diffs.
Monitor network segments hosting audio-over-IP appliances for lateral movement attempts sourced from administrator hosts.
Track firmware version inventory to identify devices still running 4.05 or 4.06.

How to Mitigate CVE-2025-65230

Immediate Actions Required

Restrict access to the Instreamer Web UI to a dedicated management VLAN and trusted administrator workstations only.
Rotate credentials on all Barix Instreamer devices and remove unused low-privileged accounts that can reach the configuration interface.
Audit current Streaming Destination values on every device and remove any entries containing HTML or script content.

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Monitor the Barix support portal and user manual for firmware updates addressing versions 4.05 and 4.06. Confirmation of the fix should be validated against release notes before deployment.

Workarounds

Place Instreamer devices behind a reverse proxy or firewall that blocks direct browser access from general-purpose user networks.
Require administrators to use a hardened, isolated browser profile when managing the device, reducing exposure of session cookies from other applications.
Disable or restrict configuration privileges for accounts that only require monitoring or playback control.

bash

# Example firewall restriction limiting Web UI access to a management host
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.5 -d <instreamer_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -d <instreamer_ip> -j DROP