CVE-2025-63211

MediumCVSS 6.1

Published: 19/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbitrary code via the addName parameter to the /vbc/core/userSetupDoc/userSetupDoc endpoint.

Risk Assessment

An attacker could execute malicious code in the victim's browser, leading to data theft, session hijacking, or unauthorized actions. This may compromise the security of the management system.

Recommendation

Update the firmware to the latest version that fixes this vulnerability. Implement input validation and XSS protection mechanisms.

Other vulnerabilities in bridgetech VBC Server & Element Manager

CVE-2025-63214Medium
An issue was discovered in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-10 and 6.5.0-9, allowing unauthorized attackers to delete and create arbitrary accounts. The vulnerability could be exploited to take control of the system.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS