CVE-2014-3738: Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web sc...

Security readout for executives and security teams

Zenoss 4.2.5 had a stored cross-site scripting issue where a device title could contain malicious web content. If viewed by another user, especially an administrator, it could run in that user’s browser. The sources do not provide CVSS scoring, confirmed active exploitation, or a named fixed version. Exposure is most likely in organizations still running Zenoss 4.2.5 with authenticated users able to create or edit device titles. Internet-exposed monitoring consoles increase risk, but the sources do not confirm default exposure or affected configurations. Prioritize remediation if Zenoss 4.2.5 is still used, especially where the console is internet-facing or shared by multiple administrators. This is not KEV-listed, but stored XSS in an admin monitoring tool can support account misuse and operational disruption. Mitigation focus: Check Zenoss vendor guidance for fixed versions or supported workarounds.; Restrict Zenoss console access to trusted administrative networks.; Upgrade away from Zenoss 4.2.5 if vendor guidance confirms a fixed release..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.