Is CVE-2025-65289 actively exploited?

No active exploitation of CVE-2025-65289 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-65289 be exploited remotely?

Partially. CVE-2025-65289 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2025-65289?

CVE-2025-65289 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2025-65289

MEDIUM

CVE-2025-65289

CWE-79Published: December 9, 2025· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the context of an administrator's browser (for example after DHCP release/renew triggers the interface to display the stored hostname). Because the management interface uses weak/basic authentication and does not properly protect or isolate session material, the XSS can be used to exfiltrate the admin session and perform administrative actions.

NVD Source

Technical Analysis

CVE-2025-65289 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.