Stored XSS in EchoCCS's Specto CM
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Stored XSS. This issue affects Specto CM: before 17032025.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix Fixed Specto CM (Echo Call Center Services Trade and Industry Inc.): 17032025
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Echo Call Center Services Trade and Industry Inc. | Specto CM | before 17032025 | 17032025 | Patch available | CNA |
- Specto CM VendorEcho Call Center Services Trade and Industry Inc. Affected before 17032025 Fixed in 17032025 Patch available CNA
Remediation
- Fix · CNA Specto CM (Echo Call Center Services Trade and Industry Inc.) Fixed in 17032025
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Echo Call Center Services Trade and Industry Specto CM 17032025
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-01888 Arbitrary File Upload in EchoCCS's Specto CMPriority MEDIUM 46
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2154
- 2026-10-03 Alias added: GHSA-rp3g-8hwh-4xwq
References
More Echo Call Center Services Trade and Industry Inc. vulnerabilities
- TI-2025-01888 Arbitrary File Upload in EchoCCS's Specto CM CVSS 3.1HIGH 8.8
Sources
- CVE-2025-2154 · CVE Program
- CVE-2025-2154 · NVD
- FIRST EPSS
- GHSA-rp3g-8hwh-4xwq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences