CVE-2025-1175: Kelio Visio Reflected XSS Vulnerability

CVE-2025-1175 Overview

CVE-2025-1175 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting Kelio Visio 1, Kelio Visio X7, and Kelio Visio X4 workforce management terminals. The flaw exists in the /PageLoginVisio.do endpoint, which fails to sanitize the username parameter of POST requests. An attacker can inject a crafted JavaScript payload that executes in the victim's browser when the malicious request is delivered through social engineering. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. It affects versions between 3.2C and 5.1K.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and arbitrary JavaScript execution in the context of authenticated Kelio Visio users.

Affected Products

Kelio Visio 1 (versions 3.2C through 5.1K)
Kelio Visio X7 (versions 3.2C through 5.1K)
Kelio Visio X4 (versions 3.2C through 5.1K)

Discovery Timeline

2025-02-10 - CVE-2025-1175 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1175

Vulnerability Analysis

The vulnerability resides in the login handler of Kelio Visio terminals. When a client submits a POST request to /PageLoginVisio.do, the application reflects the value of the username parameter back into the HTTP response without proper output encoding or input sanitization. An attacker can supply a JavaScript payload in that parameter and have the browser render it as active script content.

Because the exploit requires the victim to submit the crafted request, adversaries typically deliver the attack through phishing links, malicious forms hosted on attacker-controlled sites, or auto-submitting HTML pages. Once the payload executes, it runs in the origin of the Kelio Visio web interface with access to cookies, session tokens, and any DOM content the authenticated user can access.

The CVSS vector notes a scope change (S:C), indicating that the injected script can affect resources beyond the vulnerable component's security authority, such as authenticated administrative sessions.

Root Cause

The root cause is missing output encoding on the username request parameter within the login page rendering logic. User-supplied input is embedded directly into the HTML response, breaking the separation between data and executable script context.

Attack Vector

Exploitation requires no privileges but does require user interaction. An attacker crafts a POST request containing a JavaScript payload in the username field, then lures an authenticated user, typically an HR administrator or workforce manager, to submit that request. The reflected response executes the payload within the trusted origin.

Refer to the INCIBE Security Notice for the coordinated disclosure details.

Detection Methods for CVE-2025-1175

Indicators of Compromise

POST requests to /PageLoginVisio.do containing HTML or JavaScript syntax such as <script>, onerror=, or javascript: inside the username parameter.
HTTP referrer headers on Kelio Visio login requests originating from unfamiliar external domains.
Unexpected outbound connections from administrator browsers to attacker-controlled hosts following Kelio Visio session activity.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to /PageLoginVisio.do and block script metacharacters in the username field.
Analyze reverse proxy or web server logs for URL-encoded XSS signatures targeting the login endpoint.
Correlate Kelio Visio access logs with endpoint browser telemetry to identify suspicious script execution following login page visits.

Monitoring Recommendations

Alert on anomalous POST request volumes or oversized username parameter values reaching the Kelio Visio login endpoint.
Monitor administrator accounts for session token reuse from unexpected IP addresses after visiting the login page.
Enable Content Security Policy (CSP) violation reporting to capture blocked inline script attempts on the Kelio Visio interface.

How to Mitigate CVE-2025-1175

Immediate Actions Required

Upgrade Kelio Visio 1, X7, and X4 devices to a firmware version above 5.1K as provided by the vendor.
Restrict network access to Kelio Visio management interfaces to trusted administrative VLANs only.
Instruct administrators to avoid clicking links to the Kelio Visio login page received via email or messaging until patches are applied.

Patch Information

Bodet Software, the Kelio Visio vendor, has addressed the issue in firmware releases beyond 5.1K. Consult the INCIBE Security Notice for the specific fixed version and vendor contact for firmware distribution.

Workarounds

Place the Kelio Visio web interface behind a reverse proxy that strips or encodes HTML metacharacters in the username POST parameter.
Enforce a strict Content Security Policy that disallows inline scripts on the /PageLoginVisio.do response.
Require administrators to access the Kelio Visio interface only through a dedicated, hardened browser profile with no active sessions to other applications.

bash

# Example NGINX reverse proxy rule blocking script tags in the username parameter
location /PageLoginVisio.do {
    if ($request_method = POST) {
        if ($request_body ~* "username=[^&]*(<|%3C)script") {
            return 403;
        }
    }
    proxy_pass http://kelio-visio-backend;
}