CVE-2025-63211: Bridgetech Vbc Server

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbitrary code via the addName parameter to the /vbc/core/userSetupDoc/userSetupDoc endpoint.

Affected products

• Bridgetech Vbc Server: version 6.5.0-9 only; version 6.5.0-10 only

Published 2025-11-19. Last modified 2026-06-17.