Medium severity · published Sep 17, 2025
CVE-2025-8153
Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to…
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UI
UNIVERGE IX · NEC Corporation
from Ver.9.5 to Ver.10.7; from Ver.10.8.21 to Ver.10.8.36; from Ver.10.9.11 to Ver.10.9.24; from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 · source: vendor
UI
UNIVERGE IX-R/IX-V · NEC Corporation
Ver1.3.16, Ver1.3.21 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8153
jpn.nec.com
https://jpn.nec.com/security-info/secinfo/nv25-005_en.html
More from UNIVERGE IX
7.2
CVE-2024-11013
Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V…
4.3
CVE-2024-11014
Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a…