CVE-2025-65289

23th percentile - higher than 23% of all known CVEs

A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the context of an administrator's browser (for example after DHCP release/renew triggers the interface to display the stored hostname). Because the management interface uses weak/basic authentication and does not properly protect or isolate session material, the XSS can be used to exfiltrate the admin session and perform administrative actions.

An attacker on the LAN can hijack the router administrator's session and perform administrative actions, potentially leading to full control over the device and network traffic.

Update the Mercury MR816v2 router firmware to a version containing the fix, and until then restrict management interface access to trusted networks and change default credentials.