CVE-2025-13650: Microcom360 Zeusweb XSS Vulnerability

CVE-2025-13650 Overview

CVE-2025-13650 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Microcom360 ZeusWeb version 6.1.31. The flaw resides in the Surname parameter of the Create Account operation exposed at the ZeusWeb application endpoint. An attacker can inject arbitrary JavaScript without prior authentication because account creation is publicly accessible. Successful exploitation allows execution of attacker-controlled script in the browser context of users who view the affected data.

Critical Impact
Unauthenticated attackers can inject JavaScript through the account registration workflow, enabling session theft, credential harvesting, and client-side attacks against ZeusWeb users.

Affected Products

Microcom360 ZeusWeb version 6.1.31
Deployments exposed at zeus.microcom.es:4040 and equivalent customer-hosted instances
Web clients accessing the Create Account workflow at index.html?zeus6=true

Discovery Timeline

2026-02-11 - CVE-2025-13650 published to NVD
2026-03-20 - Last updated in NVD database

Technical Details for CVE-2025-13650

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting flaw classified under [CWE-79]. ZeusWeb fails to sanitize or encode the Surname field submitted through the Create Account form. The application reflects or stores the supplied value without neutralizing HTML or JavaScript metacharacters. When the field is rendered in a browser, the injected payload executes within the ZeusWeb origin. The attack vector is network-based and requires user interaction to trigger the malicious payload in a victim session.

Root Cause

The root cause is missing input validation and output encoding on the Surname parameter inside the account creation endpoint. ZeusWeb accepts arbitrary characters, including <, >, and quote characters, and writes them back into HTML contexts without applying context-aware escaping. This violates standard XSS defenses such as HTML entity encoding and Content Security Policy enforcement.

Attack Vector

An attacker submits a crafted Surname value containing a JavaScript payload through the public account creation endpoint at https://zeus.microcom.es:4040/index.html?zeus6=true. No authentication is required, although the registration action must be completed. When an administrator or other user later views the injected data inside ZeusWeb, the payload executes in their browser. The attacker can then hijack sessions, perform actions on behalf of the victim, or pivot to internal resources. Refer to the HackRTU CVE-2025-13650 advisory for technical reproduction details.

Detection Methods for CVE-2025-13650

Indicators of Compromise

HTTP POST requests to the ZeusWeb account creation endpoint containing <script>, onerror=, onload=, or javascript: substrings in the Surname field.
Anomalous account registrations on zeus.microcom.es:4040 with non-alphabetic characters in name fields.
Outbound browser requests from ZeusWeb sessions to unexpected external domains, suggesting payload callbacks.

Detection Strategies

Inspect web application logs for Create Account submissions containing HTML or JavaScript metacharacters in the Surname parameter.
Deploy WAF rules that flag XSS payload patterns targeting registration forms on ZeusWeb endpoints.
Review stored user records in ZeusWeb for any name fields containing markup or scripting syntax.

Monitoring Recommendations

Enable verbose request logging on the ZeusWeb reverse proxy and forward logs to a centralized SIEM for pattern analysis.
Alert on Content Security Policy violation reports from browsers accessing ZeusWeb interfaces.
Monitor administrative sessions for unexpected JavaScript errors or DOM modifications during routine user management.

How to Mitigate CVE-2025-13650

Immediate Actions Required

Restrict public access to the ZeusWeb Create Account endpoint using network ACLs or authentication proxies until a patched build is deployed.
Audit existing user records and purge entries where name fields contain HTML or JavaScript syntax.
Contact Microcom360 to confirm availability of a fixed release beyond version 6.1.31.

Patch Information

No vendor advisory or fixed version has been published in the referenced sources at the time of NVD publication. Operators should consult the Microcom360 Zeus service page and contact the vendor directly for remediation guidance. Track updates through the HackRTU disclosure blog.

Workarounds

Place ZeusWeb behind a Web Application Firewall configured to block XSS payloads in registration parameters.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on ZeusWeb origins.
Apply server-side input validation at an upstream reverse proxy to reject name fields containing <, >, or quote characters.
Train administrative users to avoid opening user management views from untrusted sessions until the issue is patched.

bash

# Example ModSecurity rule to block XSS payloads in the Surname field
SecRule ARGS:Surname "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1013650,phase:2,deny,status:403,log,\
     msg:'CVE-2025-13650 ZeusWeb Surname XSS attempt blocked'"