CVE-2025-0576: Mobotix M15 Cross-Site Scripting Flaw

CVE-2025-0576 Overview

CVE-2025-0576 is a reflected cross-site scripting (XSS) vulnerability affecting Mobotix M15 firmware version 4.3.4.83. The flaw resides in the handling of the p_qual parameter passed to the /control/player endpoint. Attackers can inject arbitrary JavaScript that executes in the browser context of a victim who loads a crafted URL. The issue is classified under CWE-79 and is exploitable remotely without authentication or user privileges. Public disclosure has occurred, and the vendor did not respond to the reporter's contact attempts prior to publication.

Critical Impact
Remote attackers can execute arbitrary script in a victim's browser session by delivering a crafted link to the Mobotix M15 web interface, enabling session data theft, interface manipulation, and phishing against camera operators.

Affected Products

Mobotix M15 firmware version 4.3.4.83
Web-accessible camera management interface (/control/player endpoint)
Deployments exposing the affected endpoint to untrusted networks

Discovery Timeline

2025-01-20 - CVE-2025-0576 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0576

Vulnerability Analysis

The vulnerability affects the request handler for /control/player?center&eventlist&pda&dummy_for_reload=1736177631&p_evt on the Mobotix M15 camera. The p_qual HTTP parameter is reflected into the server response without proper output encoding or input sanitization. An attacker who supplies script content through p_qual triggers execution in the victim's browser when the response is rendered.

The flaw is reflected rather than stored, so successful exploitation requires a target to load an attacker-controlled URL pointing at the vulnerable camera. The attack is network-reachable and requires no authentication, but user interaction is needed to trigger the payload. Public exploitation details are already available through third-party disclosure trackers.

Root Cause

The root cause is missing neutralization of user-controlled input before it is embedded in web page output, consistent with CWE-79. The p_qual parameter value is written to the response HTML without HTML-entity encoding or contextual escaping. Any characters with syntactic meaning in HTML or JavaScript pass through unchanged, allowing arbitrary markup and script to be injected into the rendered page.

Attack Vector

An attacker crafts a URL targeting the Mobotix M15 web interface with a malicious p_qual value containing JavaScript. The attacker delivers this URL to a camera operator or administrator through phishing, chat, or a link on a controlled site. When the victim opens the link while authenticated to the camera, the injected script executes with the victim's session context. The script can exfiltrate session tokens, issue authenticated requests to the camera, alter displayed content, or redirect the user to attacker-controlled infrastructure. See the VulDB entry for this issue for additional technical details.

Detection Methods for CVE-2025-0576

Indicators of Compromise

HTTP requests to /control/player containing script tags, event handlers, or encoded JavaScript in the p_qual parameter.
Referrer headers pointing at untrusted external hosts on requests to the camera management interface.
Anomalous outbound requests from operator workstations immediately after loading a Mobotix camera URL.

Detection Strategies

Inspect web proxy and camera access logs for requests where p_qual contains characters such as <, >, ", ', or URL-encoded equivalents like %3Cscript.
Deploy a web application firewall rule in front of exposed Mobotix devices to flag reflected XSS patterns against the /control/player path.
Correlate camera interface access with subsequent unexpected authenticated actions from the same session.

Monitoring Recommendations

Log and retain full URL query strings for all traffic to Mobotix M15 devices to support retrospective analysis.
Alert on external referrers or unusual geographic origins accessing the camera management path.
Monitor operator browsers for unexpected script errors or content security policy violations tied to camera URLs.

How to Mitigate CVE-2025-0576

Immediate Actions Required

Restrict network access to the Mobotix M15 web interface so that it is reachable only from trusted management networks or a VPN.
Instruct camera operators to avoid clicking URLs to the camera interface received through email, chat, or external sites.
Terminate active administrative sessions and rotate any credentials that may have been exposed to a crafted link.

Patch Information

No vendor patch is currently referenced for CVE-2025-0576. The reporter noted that the vendor was contacted but did not respond. Administrators should track the VulDB advisory and Mobotix vendor channels for future firmware updates addressing the p_qual parameter handling.

Workarounds

Place the camera behind a reverse proxy that strips or validates the p_qual parameter and rejects requests containing HTML or script metacharacters.
Enforce a strict Content Security Policy at the proxy layer to block inline script execution on responses from the camera.
Segment cameras onto a dedicated VLAN with no outbound internet access to limit data exfiltration if a session is hijacked.
Require operators to access the camera interface only from hardened, dedicated management workstations.

bash

# Example nginx reverse proxy rule to block script-like content in p_qual
location /control/player {
    if ($arg_p_qual ~* "(<|>|script|onerror|onload|javascript:|%3C|%3E)") {
        return 403;
    }
    proxy_pass http://mobotix-m15.internal;
}