CVE-2025-65231

MediumCVSS 6.1

Published: 08/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field, which is stored and later rendered on the Status page.

Risk Assessment

A malicious script stored in the CTS close command field may execute in the browser of an administrator visiting the Status page, potentially leading to session theft or unauthorized actions.

Recommendation

Update Barix Instreamer software to a version newer than v04.06 and restrict access to the Web UI to trusted networks.

Other vulnerabilities in Barix Instreamer

CVE-2025-65230Medium
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destination input.

Original NVD description (English source)

Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS