CVE-2025-65289
📋 TL;DR
A stored XSS vulnerability in Mercury MR816v2 routers allows attackers on the local network to inject malicious JavaScript into the router's management interface via hostname submission. This can lead to session hijacking of administrator accounts. Only users of this specific router model with the vulnerable firmware are affected.
💻 Affected Systems
- Mercury MR816v2 router
📦 What is this software?
Mr816 Firmware by Mercurycom
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to change all settings, intercept traffic, install backdoors, or brick the device.
Likely Case
Administrative session theft leading to unauthorized configuration changes, DNS hijacking, or network reconnaissance.
If Mitigated
Limited to internal network attackers only, with proper network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires LAN access but no authentication; basic web development skills sufficient to craft payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates. If unavailable, consider workarounds or replacement.
🔧 Temporary Workarounds
Network Segmentation
allIsolate router management interface to dedicated VLAN or restrict access to trusted management hosts only.
Disable DHCP Hostname Submission
allIf possible, disable or restrict DHCP client hostname submission functionality in router settings.
🧯 If You Can't Patch
- Replace router with supported model receiving security updates
- Implement strict network access controls to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface. If version matches affected version, assume vulnerable.Check Version:
Login to router web interface and check System Status or About page for firmware version.Verify Fix Applied:
Test XSS payload submission via DHCP hostname field; if sanitized/blocked, fix may be applied.📡 Detection & Monitoring
Log Indicators:
- Unusual DHCP requests with long or JavaScript-containing hostnames
- Multiple failed admin login attempts from unexpected sources
Network Indicators:
- HTTP requests to router management interface with suspicious parameters
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" AND (hostname CONTAINS "<script>" OR hostname CONTAINS "javascript:")