[Japanese]

JVNDB-2025-000074

Multiple vulnerabilities in desknet's NEO

Overview

desknets NEO provided by NEOJAPAN Inc. contains multiple vulnerabilities listed below.
  • Stored cross-site scripting (CWE-79) - CVE-2025-24833, CVE-2025-54760, CVE-2025-55072

  • Reflected cross-site scripting (CWE-79) - CVE-2025-52583

  • Stored cross-site scripting (CWE-79) - CVE-2025-54859

  • Improper protection of alternate path in AppSuite (CWE-424) - CVE-2025-58079

  • Use of hard-coded cryptographic key (CWE-321) - CVE-2025-58426


The following people reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2025-24833
Reporter: Sho Odagiri of GMO Cybersecurity by Ierae, Inc.

CVE-2025-52583, CVE-2025-54760
Reporter: Ryo Sato

CVE-2025-54859
Reporter: Ryo Sato and Daijiro Obata

CVE-2025-55072, CVE-2025-58079, CVE-2025-58426
Reporter: Kentaro Ishii of GMO Cybersecurity by Ierae, Inc.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.1 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-52583

CVSS V3 Severity:
Base Metrics:5.4 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-24833, CVE-2025-54760, CVE-2025-55072

CVSS V3 Severity:
Base Metrics:4.8 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Changed
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-54859

CVSS V3 Severity:
Base Metrics:4.3 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-58079

CVSS V3 Severity:
Base Metrics:4.3 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-58426
Affected Products


NEOJAPAN Inc.
  • desknet's Web Server (CVE-2025-52583)
  • desknet's NEO V4.0R1.0 to V9.0R2.0 (CVE-2025-24833, CVE-2025-58079, CVE-2025-58426)
  • desknet's NEO V9.0R2.0 and earlier (CVE-2025-54760, CVE-2025-54859)
  • desknet's NEO V2.0R1.0 to V9.0R2.0 (CVE-2025-55072)

Impact

  • An arbitrary JavaScript may be executed in the web browser of the user of the product (CVE-2025-24833, CVE-2025-52583, CVE-2025-54760, CVE-2025-54859, CVE-2025-55072)

  • Malicious AppSuite apps may be created by a remote authenticated attacker (CVE-2025-58079, CVE-2025-58426)
Solution

For CVE-2025-24833, CVE-2025-54760, CVE-2025-54859, CVE-2025-55072, CVE-2025-58079, CVE-2025-58426:
[Update the Software]
Update the software to the latest version according to the information provided by the developer.

For CVE-2025-52583:
[Stop using desknet's Web Server and switch to IIS]
The developer recommends that users stop using desknet's Web Server and switch to Internet Information Services (IIS). For more details, refer to the information provided by the developer.
Vendor Information

NEOJAPAN Inc.
CWE (What is CWE?)

  1. Cross-site Scripting(CWE-79) [IPA Evaluation]
  2. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2025-24833
  2. CVE-2025-52583
  3. CVE-2025-54760
  4. CVE-2025-55072
  5. CVE-2025-58079
  6. CVE-2025-58426
  7. CVE-2025-54859
References

  1. JVN : JVN#90757550
Revision History

  • [2025/10/16]
      Web page was published

Date Public2025/10/16
Date First Published2025/10/16
Date Last Updated2025/10/16