Protectel PROTECTELMAJ CVE-2025-68395

Exploitation requires access to the note-editor module of PROTECTELMAJ or BDF and the ability to create or edit a note, into which the attacker stores arbitrary HTML/JavaScript; the payload only executes when another user subsequently opens/renders that note (UI:P, passive user interaction). Limiting factors: the attack is confined to the note-editor feature; the supplied vector indicates adjacent-network reachability (AV:A) rather than open-internet exposure; and a second user must view the malicious note for impact to occur. The privilege precondition is unresolved - the description states a low-privileged attacker is needed while the CVSS vector states PR:N, so authentication requirements are not confirmed from available data and should be verified with the vendor.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) with no amplifying exploitation signals: EPSS is not provided, the CVE is not in CISA KEV, and no public exploit or PoC reference is supplied - so this is best read as a genuine-but-non-urgent issue rather than a high-priority emergency. The vuln.today decision label is 'this_month', consistent with a patch-when-you-can posture rather than act_now/emergency. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows no impact on the vulnerable system itself but low confidentiality and integrity impact on a subsequent system (the victim's browser/session), which is the normal shape for stored XSS. Two signals conflict and should be verified with the vendor/CERT-PL: the CVSS vector states PR:N (no privileges / unauthenticated), but the description explicitly says 'a low privileged attacker' injects the payload - these cannot both be true, so treat the authentication precondition as unresolved. The vector also states AV:A (adjacent) rather than the AV:N typical for web-delivered stored XSS, implying the module may be reachable only from an adjacent/internal network segment rather than the open internet; confirm the deployment's network exposure. Net: a real but bounded risk, gated by account access and victim interaction, not a wormable or mass-exploitable flaw.

A user with low-privileged access to a Protectel PROTECTELMAJ or BDF instance creates or edits a note in the note-editor module and embeds malicious HTML/JavaScript. When another user - potentially a higher-privileged operator - later opens that note, the stored script executes in their browser session, enabling session/credential theft or actions in the victim's context. No public exploit code is identified at time of analysis, and execution depends on the victim viewing the crafted note (UI:P).