CVE-2021-25680: The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) i...

Security readout for executives and security teams

CVE-2021-25680 is a reflected cross-site scripting issue in AdTran Personal Phone Manager. Affected systems include at least version 10.8.1 and below. The associated NetVanta 7060 and 7100 appliances are end of life, and the CVE record states the issue will not be patched. Business urgency depends on whether this web interface is reachable by users or networks an attacker can influence. Exposure is most relevant where AdTran Personal Phone Manager is still deployed, especially on NetVanta 7060 or 7100 appliances. Risk increases if the management or phone-manager web interface is reachable from broad internal networks, remote users, or the internet. Because affected appliances are end of life, long-term exposure may persist without vendor patches. Treat this as a medium-priority remediation and lifecycle-risk issue. There is no cited active exploitation, but the affected appliances are end of life and the CVE states no patch will be issued. Prioritize replacement or isolation where the interface is reachable beyond tightly controlled networks. Mitigation focus: Identify any AdTran Personal Phone Manager deployments and versions in use.; Restrict access to the Personal Phone Manager interface to trusted management networks.; Consider retiring or replacing NetVanta 7060 and 7100 appliances due to end-of-life status..

Prepared

Jul 11, 2026, 12:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.