CVE-2025-25431

Summary

CVE-2025-25431 is a stored Cross-site Scripting (XSS) vulnerability affecting Trendnet TEW-929DRU v1.0.0.10. This issue arises due to improper input validation on the /captive_portal.htm page's wifi_data parameter, specifically the ssid key. An attacker can exploit this vulnerability by injecting malicious scripts into the affected device, posing a significant risk for data theft or unauthorized access when a user visits a specially crafted webpage. Users are strongly advised to update their routers to the latest firmware version to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.