Medium · 5.1 CVE-2025-10546 EUVD-2025-29571GHSA-rc2v-gr94-vj6f

Cross-Site Scripting (XSS) Vulnerability in PPC XPON ONT Wi-Fi Router

Published Sep 16, 2025 · Updated Sep 16, 2025 · Assigned by CERT-In

Vendor: PPC Technologies Product: PPC XPON ONT (Optical Network Terminal) 2K15X

Description

This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal. A remote attacker could exploit this vulnerability by injecting malicious JavaScript into the vulnerable parameter, leading to a reflected Cross-Site Scripting (XSS) attack on the targeted system.

Affected products

Vendor	Product	Affected	Fixed
PPC Technologies	PPC XPON ONT (Optical Network Terminal) 2K15X	v2.3.15PPCL, v1.0.3	—

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0215 third-party-advisory