Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-70545 — Stored XSS proof-of-concept for PPC (Belden) ONT 2K05X router firmware v1.1.9_206L, with reproduction steps and mitigation guidance for the vulnerable CGI component. | Kitploit
Tools/GitHubGitHub/jeyabalaji711/cve-2025-70545
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubjeyabalaji711/cve-2025-70545

CVE-2025-70545

Stored XSS proof-of-concept for PPC (Belden) ONT 2K05X router firmware v1.1.9_206L, with reproduction steps and mitigation guidance for the vulnerable CGI component.

View Repository
17 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

PPC (Belden) ONT 2K05X router

Author : Jeyabalaji
Affected Product Code Base: PPC 2K05X Router - V1.1.9_206L
Tested on : Windows 11
CVE : CVE-2025-70545

Description:

A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The Common Gateway Interface (CGI) component improperly handles user-supplied input, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript that is persistently stored and executed when the affected interface is accessed.

Affected Component:

Web management interface, Common Gateway Interface (CGI)

Steps to reproduce :

  1. Send a crafted HTTP request to the web management interface with a modified browserLang parameter.
  2. Observe that the supplied value is stored by the backend logic.
  3. Access the affected management interface using a web browser.
  4. Confirm that the stored browserLang value is rendered and executed in the browser context.

Mitigation:

Input validation and output encoding should be enforced in the CGI component.User-supplied input must be properly sanitized before storage and rendering.

Download Tool