Read the docs
TI-2025-42717 Aliases CVE-2025-69268GHSA-6ggp-xr3v-7c8x

Spectrum reflected XSS

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 6th percentileScored 2026-11-07
Fix Fixed DX NetOps Spectrum (Broadcom): 24.3.9 and later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BroadcomDX NetOps Spectrumup to 24.3.824.3.9 and laterPatch availableCNA
  • DX NetOps Spectrum VendorBroadcom Affected up to 24.3.8 Fixed in 24.3.9 and later Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:dx_netops_spectrum:*:*:*:*:*:*:*:*before 24.3.9VulnerableBroadcom
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:broadcom:dx_netops_spectrum:*:*:*:*:*:*:*:* Versions before 24.3.9 Vulnerable ·Broadcom
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA DX NetOps Spectrum (Broadcom) Fixed in 24.3.9 and later

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Broadcom DX NetOps Spectrum — support.broadcom.com/web/ecx/support-content-notification/-…

    10 records Highest priority Priority MEDIUM 2 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2025-42722 Spectrum broken authenticationPriority MEDIUM 40
    • TI-2025-42716 Spectrum directory path traversalPriority MEDIUM 40
    • TI-2025-42718 Spectrum command injection in NCM servicePriority LOW 33
    Show all 10 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-69268
  2. 2026-10-03 Alias added: GHSA-6ggp-xr3v-7c8x

References

Advisory 1

  • TI-2025-42722 Spectrum broken authentication CVSS 4.0HIGH 8.7
  • TI-2025-42716 Spectrum directory path traversal CVSS 4.0HIGH 8.8
  • TI-2025-42718 Spectrum command injection in NCM service CVSS 4.0HIGH 7.1
  • TI-2025-42724 Spectrum outdated java library in class-path CVSS 4.0HIGH 7.1
  • TI-2025-42721 Spectrum password returned in clear CVSS 4.0MEDIUM 5.3
  • TI-2025-42725 Spectrum insecure deserialiation CVSS 4.0LOW 2.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences