CVE-2025-13589: FMS by Otsuka IT Reflected XSS Flaw

CVE-2025-13589 Overview

CVE-2025-13589 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the FMS product developed by Otsuka Information Technology. The flaw allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL through phishing or social engineering. Successful exploitation requires the target to click the malicious link, at which point injected script executes in the context of the FMS web application.

Critical Impact
Attackers can hijack authenticated user sessions, steal credentials from the FMS interface, or perform actions on behalf of the victim inside the application.

Affected Products

FMS by Otsuka Information Technology (specific version range not published in NVD)

Discovery Timeline

2025-11-24 - CVE-2025-13589 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13589

Vulnerability Analysis

The vulnerability is a classic Reflected XSS issue in the FMS web application. User-supplied input from an HTTP request is reflected back into the server's response without proper output encoding or input sanitization. When a victim loads a URL crafted by an attacker, the reflected payload is parsed by the browser as active script content and executes within the origin of the FMS application.

Because the flaw is reflected rather than stored, exploitation depends on delivering the crafted URL to a target, typically through phishing email, chat messages, or malicious redirects. No authentication is required to craft or send the payload, and interaction with the FMS server occurs only when the victim clicks the link.

The scope of impact is limited to the victim's browser session with FMS. Attackers can read and manipulate the page DOM, exfiltrate session cookies not protected by HttpOnly, harvest form input including credentials, and issue authenticated requests to the FMS backend on behalf of the victim.

Root Cause

The root cause is missing or incomplete neutralization of user-controlled input during web page generation, consistent with CWE-79. Request parameters are echoed into HTML, JavaScript, or attribute contexts without contextual encoding, allowing markup and script constructs to break out of the intended data context.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to an FMS endpoint containing a malicious payload in a reflected parameter, then delivers that URL to a target user via phishing. When the user visits the link, the FMS server returns a response containing the attacker-controlled script, which the browser executes. See the Taiwan CERT Advisory CP-139-10521 for the vendor coordination details.

Detection Methods for CVE-2025-13589

Indicators of Compromise

Inbound HTTP requests to FMS endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: sequences in query string parameters.
Referrer headers pointing to external phishing domains, followed by anomalous outbound requests from user browsers to attacker-controlled hosts.
FMS access logs showing repeated requests to the same endpoint with varied payload permutations, indicating payload tuning.

Detection Strategies

Deploy web application firewall (WAF) rules to flag reflected XSS payload patterns in FMS request parameters and log matches for review.
Correlate FMS web server logs with email gateway telemetry to identify users who received and clicked suspicious links referencing FMS URLs.
Enable Content Security Policy (CSP) violation reporting to surface script executions that deviate from the FMS baseline.

Monitoring Recommendations

Monitor FMS authentication logs for session activity originating from unexpected IP addresses or user agents shortly after a user clicks an external link.
Alert on FMS API calls that occur out of normal workflow sequence, which may indicate scripted actions performed via XSS.
Track browser telemetry for unusual DOM modifications or outbound fetch/XMLHttpRequest calls from FMS pages.

How to Mitigate CVE-2025-13589

Immediate Actions Required

Contact Otsuka Information Technology to obtain the fixed FMS release and apply it according to the Taiwan CERT Advisory CP-132-10520.
Restrict FMS access to trusted networks or VPN users until patching is complete.
Notify FMS users about active phishing risk and instruct them not to click FMS links received from untrusted sources.

Patch Information

Refer to the Taiwan CERT advisories for the authoritative patch guidance from Otsuka Information Technology. The NVD entry does not publish a specific fixed version string; administrators should request the remediated build directly from the vendor.

Workarounds

Deploy a WAF in front of FMS with rules that block reflected XSS payload patterns in request parameters.
Enforce a strict Content Security Policy on FMS responses to disallow inline scripts and restrict script sources to trusted origins.
Set HttpOnly and Secure flags on FMS session cookies to reduce the impact of successful script execution.
Enable browser-based XSS protections and modern SameSite cookie policies to limit cross-site request abuse.

bash

# Example WAF rule pattern (ModSecurity) to log reflected XSS attempts against FMS
SecRule ARGS "@rx (?i)(<script|javascript:|onerror\s*=|onload\s*=)" \
    "id:1013589,phase:2,deny,status:403,log,msg:'CVE-2025-13589 Reflected XSS attempt against FMS'"