CVE-2025-13648: ZeusWeb Stored XSS Vulnerability

CVE-2025-13648 Overview

CVE-2025-13648 is a stored Cross-Site Scripting (XSS) vulnerability affecting the ZeusWeb web application developed by Microcom. An authenticated attacker can inject arbitrary JavaScript code through the 'Name' and 'Surname' parameters within the 'My Account' section of the application. The malicious script is stored on the server and executed in the browsers of other users who view the affected content, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of legitimate users.

Critical Impact

Authenticated users can inject persistent malicious scripts that execute in other users' browsers, potentially compromising user sessions and sensitive data within the ZeusWeb application.

Affected Products

• Microcom ZeusWeb version 6.1.31

Discovery Timeline

• February 11, 2026 - CVE CVE-2025-13648 published to NVD
• February 11, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13648

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists due to insufficient input validation and output encoding in the ZeusWeb application's user profile management functionality. When a registered user modifies their account information through the 'My Account' section, the application fails to properly sanitize the 'Name' and 'Surname' input fields before storing them in the database and subsequently rendering them in the browser.

The attack requires authentication to the ZeusWeb platform, meaning an attacker must first register or have valid credentials to access the vulnerable functionality. Once the malicious payload is stored, it persists in the application's database and is executed each time the affected content is rendered, making this a stored (persistent) XSS attack rather than a reflected one.

Root Cause

The root cause of this vulnerability is improper input validation and lack of output encoding in the ZeusWeb application. The 'Name' and 'Surname' parameters in the user account management functionality at the /administracion-estaciones.html endpoint do not adequately sanitize user-supplied input. This allows HTML and JavaScript code to be stored in the database and later rendered without proper encoding, enabling script execution in the context of other users' browser sessions.

Attack Vector

The attack is network-based and requires low privileges (registered user account) along with user interaction from a victim viewing the malicious content. An attacker would:

1. Register or log into the ZeusWeb application
2. Navigate to the 'My Account' section
3. Insert a JavaScript payload into the 'Name' or 'Surname' fields (e.g., <script>alert(document.cookie)</script>)
4. Save the profile changes
5. The malicious script is stored and executes when other users or administrators view the attacker's profile information

For technical details regarding the vulnerability, refer to the HackRTU security advisory.

Detection Methods for CVE-2025-13648

Indicators of Compromise

• Unusual JavaScript patterns or HTML tags stored in user profile 'Name' and 'Surname' database fields
• Presence of <script>, <img onerror=, <svg onload=, or similar XSS payload patterns in user account data
• Browser console errors or unexpected script execution when viewing user profiles
• Anomalous outbound network requests from the ZeusWeb application to unknown domains

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in HTTP POST requests to user profile endpoints
• Configure database monitoring to alert on HTML/JavaScript content being stored in text fields designated for names
• Deploy Content Security Policy (CSP) headers with reporting enabled to detect XSS execution attempts
• Review application logs for suspicious modifications to user account fields containing encoded characters or script tags

Monitoring Recommendations

• Enable detailed logging for all modifications to user profile data in the ZeusWeb application
• Monitor for Content Security Policy violation reports if CSP is implemented
• Set up alerts for database entries containing common XSS indicators such as <script>, javascript:, or event handlers
• Implement real-time monitoring of user session activities for signs of hijacking following profile views

How to Mitigate CVE-2025-13648

Immediate Actions Required

• Audit all existing user profile records in the ZeusWeb database for stored XSS payloads and sanitize any malicious content found
• Implement strict input validation on the 'Name' and 'Surname' fields to reject HTML tags and special characters
• Apply output encoding (HTML entity encoding) when rendering user-supplied data in the browser
• Consider temporarily restricting access to the 'My Account' profile editing functionality until a patch is available

Patch Information

At the time of publication, no official patch has been released by Microcom for ZeusWeb version 6.1.31. Organizations using this software should contact Microcom directly for security updates and monitor the Microcom ZeusWeb service page for announcements. Additional technical details are available in the HackRTU advisory.

Workarounds

• Implement a Web Application Firewall (WAF) with XSS protection rules in front of the ZeusWeb application
• Deploy Content Security Policy (CSP) headers to restrict inline script execution: Content-Security-Policy: script-src 'self';
• Apply input validation at the database layer to reject entries containing HTML tags in name fields
• Restrict user registration capabilities to limit potential attackers' ability to create accounts

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or httpd.conf to mitigate XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"