CVE-2025-25429

Summary

CVE-2025-25429 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Trendnet TEW-929DRU 1.0.0.10 firmware. This issue resides in the have_same_name function on the /addschedule.htm page, specifically in the r_name variable. An attacker can exploit this flaw by injecting malicious scripts into the targeted web application, leading to unintended execution of malicious code when the vulnerable page is accessed by other users. The consequences could include data theft, session hijacking, or even system takeover. Users are advised to apply the necessary patches or updates as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.