CVE-2025-21603 Details
Description
Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product and manipulates the device settings, an arbitrary script may be executed on the logged-in user's web browser when accessing a crafted URL.
A cross-site scripting vulnerability has been identified in the PLANEX Communications MZK-DP300N wireless LAN router, affecting firmware versions through 1.05. This vulnerability allows an attacker who is logged in to the device to execute arbitrary scripts in the web browser of a user accessing a specially crafted URL.
Users are advised to update the firmware to the latest version. The latest version can be downloaded from the PLANEX Communications support website for the MZK-DP300N.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 8, 2025CISA-ADP
Assessed Jan 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN57428125/ | [email protected] | AdvisoryRemedy |
| https://www.planex.co.jp/support/download/mzk-dp300n/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PLANEX COMMUNICATIONS MZK-DP300N | <= 1.05 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 8, 2025 | CVE Modified | CISA-ADP |
| Jan 8, 2025 | New CVE Received | [email protected] |