CVE-2025-2212 in CBW383G2N
Summary
by MITRE • 03/12/2025
A vulnerability was found in Castlenet CBW383G2N up to 20250301. It has been classified as problematic. This affects an unknown part of the file /RgSwInfo.asp. The manipulation of the argument Description with the input <img/src/onerror=prompt(8)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/29/2026
The vulnerability identified as CVE-2025-2212 represents a critical cross site scripting flaw discovered in Castlenet CBW383G2N firmware versions up to 20250301. This security weakness resides within the web interface component, specifically in the /RgSwInfo.asp file which handles software information display functionality. The vulnerability stems from inadequate input validation and sanitization mechanisms that fail to properly escape or filter user-supplied data before rendering it in web responses. The flaw manifests when the Description parameter processes malicious input containing the payload <img/src/onerror=prompt(8)>, which demonstrates the classic XSS exploitation pattern where inline JavaScript execution is triggered through malformed image tags.
The technical implementation of this vulnerability aligns with CWE-79 which categorizes cross site scripting as a code injection flaw that allows attackers to execute malicious scripts in the context of other users' browsers. The attack vector is remotely exploitable, meaning an adversary can initiate the malicious payload without requiring physical access or local network presence. The specific payload utilizes the onerror event handler of the img tag which executes JavaScript when an image fails to load, effectively bypassing basic security filters that might not account for such event-based execution patterns. This type of vulnerability falls under the ATT&CK technique T1059.007 for Command and Scripting Interpreter, specifically targeting web application interfaces.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with potential access to sensitive user sessions and data. An attacker could leverage this XSS flaw to steal session cookies, redirect users to malicious sites, or inject additional payloads that could escalate privileges within the device's administrative interface. The fact that the exploit has been publicly disclosed and is potentially in use increases the immediate risk profile, as the vulnerability can be exploited by threat actors without requiring advanced technical knowledge. The lack of vendor response despite early notification creates a particularly concerning scenario where users remain exposed to known threats without official remediation guidance.
Mitigation strategies should focus on immediate input sanitization and output encoding implementations that prevent the execution of embedded JavaScript within web responses. Network segmentation and web application firewalls can provide additional protective layers, while regular firmware updates remain the primary defense mechanism. Organizations should implement comprehensive monitoring for suspicious web traffic patterns and establish incident response procedures to address potential exploitation attempts. The vulnerability demonstrates the critical importance of maintaining up-to-date firmware and the necessity of proactive security assessments for network infrastructure devices. Given the public disclosure status and lack of vendor response, immediate defensive measures are essential to protect against potential exploitation attempts that could compromise network security and user privacy.