CVE-2025-57202 is a stored XSS vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003. Attackers can exploit this by injecting crafted payloads into the username field, which are then stored and executed in users' browsers when the affected page is viewed. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of displayed content. The vulnerability requires no privileges and has low attack complexity, but user interaction is required to trigger the payload.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to disclosure of sensitive information or manipulation of web content. The confidentiality and integrity impacts are rated as low, with no impact on availability. The vulnerability does not require authentication and can be triggered remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the username field. Monitor vendor communications for patches or updates addressing this vulnerability.