CVE-2025-65349: Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 15 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-65349, organizations should first restrict access to the router’s web management interface by limiting it to trusted networks and using strong authentication mechanisms. Network segmentation can prevent unauthorized access from less secure network segments. Administrators should monitor router logs and network traffic for unusual activity indicative of exploitation attempts. If possible, disable the repeater functionality or SSID broadcasting features that accept external input until a fix is released. Educate users about the risks of interacting with suspicious network devices or SSIDs. Implement web application firewalls (WAFs) or intrusion detection systems (IDS) that can detect and block XSS payloads targeting the router’s interface. Finally, maintain an inventory of network devices to quickly identify and isolate vulnerable hardware.
Description
CVE-2025-65349 is a stored Cross-Site Scripting (XSS) vulnerability found in the web management interface of the Each Italy Wireless Mini Router WIRELESS-N 300M v28K. MiniRouter.20190211. The vulnerability arises from improper sanitization of the repeater AP SSID value, which is reflected on the /index.htm page, allowing attackers to inject and execute arbitrary scripts. Exploitation requires the attacker to have low privileges and some user interaction, but it can lead to partial compromise of confidentiality and integrity. The CVSS score is 5.4 (medium severity), indicating moderate risk. No known exploits are currently in the wild, and no patches have been published yet. European organizations using this router model should be cautious, especially in countries with higher deployment of this hardware.