CVE-2025-14701 - Vulnerability Details - OpenCVE

An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Arcadia Technology	Crafty Controller

No data.

No data.

References

Link	Providers
https://gitlab.com/crafty-controller/crafty-4/-/issues/647

History

Wed, 17 Dec 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 17 Dec 2025 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Arcadia Technology Arcadia Technology crafty Controller
Vendors & Products		Arcadia Technology Arcadia Technology crafty Controller

Wed, 17 Dec 2025 00:30:00 +0000

Type	Values Removed	Values Added
Description		An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.
Title		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
Weaknesses		CWE-79
References		https://gitlab.com/crafty-controller/crafty-4/-/issues/647
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2025-12-17T00:04:32.259Z

Updated: 2025-12-17T21:20:58.124Z

Reserved: 2025-12-14T14:55:30.519Z

Link: CVE-2025-14701

Vulnrichment

Updated: 2025-12-17T21:20:54.000Z

NVD

Status : Awaiting Analysis

Published: 2025-12-17T01:15:59.773

Modified: 2025-12-18T15:08:06.237

Link: CVE-2025-14701

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14701", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2025-12-14T14:55:30.519Z", "datePublished": "2025-12-17T00:04:32.259Z", "dateUpdated": "2025-12-17T21:20:58.124Z"}, "containers": {"cna": {"title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller", "descriptions": [{"lang": "en", "value": "An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification."}], "affected": [{"vendor": "Arcadia Technology, LLC", "product": "Crafty Controller", "versions": [{"version": "0", "status": "affected", "lessThan": "4.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/647", "name": "GitLab Issue #647", "tags": ["issue-tracking", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.2"}], "credits": [{"lang": "en", "value": "Thank you to [Rozza / rchar](https://gitlab.com/rchar) on GitLab for reporting this issue.", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2025-12-17T00:04:32.259Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-17T21:20:31.643289Z", "id": "CVE-2025-14701", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T21:20:58.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14701", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T21:20:31.643289Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T21:20:54.000Z"}}], "cna": {"title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller", "credits": [{"lang": "en", "type": "finder", "value": "Thank you to [Rozza / rchar](https://gitlab.com/rchar) on GitLab for reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arcadia Technology, LLC", "product": "Crafty Controller", "versions": [{"status": "affected", "version": "0", "lessThan": "4.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.2"}], "references": [{"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/647", "name": "GitLab Issue #647", "tags": ["issue-tracking", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2025-12-17T00:04:32.259Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14701", "state": "PUBLISHED", "dateUpdated": "2025-12-17T21:20:58.124Z", "dateReserved": "2025-12-14T14:55:30.519Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2025-12-17T00:04:32.259Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}