CVE-2025-41406

Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the moderator user.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - vultures@jpcert.or.jp

Published

2025-05-30

Last modified

2025-05-30

Weaknesses

CWE-79

Affected products

• Wivia 5 Firmware (Uchida)
• Wivia 5 (Uchida Yoko Co. Ltd.)

References

• https://jvn.jp/en/jp/JVN51394666/
• https://www.uchida.co.jp/wivia/support02.html