CVE-2025-25612 is a Cross Site Scripting (XSS) vulnerability in FS Inc S3150-8T2F devices prior to version S3150-8T2F_2.2.0D_135103. The flaw exists in the Time Range Configuration functionality of the administration interface, where the "Time Range Name" input is improperly sanitized. An attacker with limited privileges can inject malicious JavaScript code that executes in the browsers of users who view the affected page, including administrators. This can lead to arbitrary script execution with potential confidentiality, integrity, and availability impacts. The product is delivered as a cloud service, and the vendor manages remediation. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with limited privileges to execute arbitrary JavaScript in the context of the affected administration interface users' browsers. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating a high severity vulnerability. The vulnerability affects the cloud-hosted service version prior to S3150-8T2F_2.2.0D_135103.

The vendor provides a patch for this vulnerability in version S3150-8T2F_2.2.0D_135103 or later. Since this is a cloud service, the vendor typically manages remediation server-side. Users and administrators should verify with the vendor advisory that their service instance has been updated to the fixed version. No additional mitigation actions are specified by the vendor advisory.