CVE-2025-13650: Microcom ZeusWeb XSS Vulnerability

CVE-2025-13650 Overview

CVE-2025-13650 is a Cross-Site Scripting (XSS) vulnerability affecting Microcom ZeusWeb, a web application used for service management. The vulnerability allows an attacker with access to the application to inject arbitrary JavaScript code through the 'Surname' parameter during the 'Create Account' operation. Notably, registration is not required to exploit this vulnerability—the attacker only needs to perform the account creation action to trigger the XSS payload.

This stored XSS vulnerability exists in the account registration workflow, where user-supplied input in the Surname field is not properly sanitized before being rendered in the web application, enabling malicious script execution in the context of other users' browsers.

Critical Impact

Attackers can inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users.

Affected Products

• Microcom ZeusWeb version 6.1.31

Discovery Timeline

• February 11, 2026 - CVE-2025-13650 published to NVD
• February 11, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13650

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the account creation functionality of ZeusWeb, specifically within the handling of the 'Surname' input field. When a user creates an account, the application fails to properly sanitize or encode the surname value before storing it and subsequently rendering it in the web interface.

The attack requires network access and user interaction—the attacker must craft a malicious payload and have a victim interact with the stored content. Upon successful exploitation, attackers can achieve limited confidentiality and integrity impacts within the context of the victim's browser session.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the ZeusWeb application's account creation module. The 'Surname' parameter accepts arbitrary input including HTML and JavaScript code, which is then stored in the application's database without proper sanitization. When this data is later displayed to users or administrators, the malicious code executes in their browser context.

Attack Vector

The attack is executed over the network through the following workflow:

1. An attacker navigates to the ZeusWeb Create Account page at the vulnerable endpoint
2. The attacker crafts a malicious XSS payload and enters it into the 'Surname' field
3. Upon form submission, the payload is stored in the application database
4. When other users or administrators view accounts or user listings, the stored JavaScript executes
5. The malicious script can then steal session cookies, perform actions as the victim, or redirect to phishing pages

The vulnerability requires no prior authentication—the attacker simply needs to access the public account creation form to inject the malicious payload. For technical details on the specific XSS payload and exploitation mechanics, refer to the HackRTU CNA CVE-2025-13650 Analysis.

Detection Methods for CVE-2025-13650

Indicators of Compromise

• Unusual JavaScript patterns or HTML tags in user account 'Surname' fields in the database
• Web server logs showing suspicious characters or encoded script tags in POST requests to the account creation endpoint
• Browser-side alerts or unexpected redirects when viewing user account information
• Session token theft attempts or unauthorized API calls originating from trusted user sessions

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payload patterns in form submissions
• Deploy Content Security Policy (CSP) headers to prevent inline script execution
• Monitor application logs for suspicious characters in the Surname field including <script>, javascript:, and event handlers like onerror
• Enable SentinelOne's web application protection module to detect XSS injection attempts in real-time

Monitoring Recommendations

• Set up alerts for HTTP POST requests to /index.html containing script tags or JavaScript event handlers
• Monitor for changes in user account data that include HTML special characters
• Track session anomalies that may indicate successful XSS exploitation such as rapid session token changes
• Review access logs for the ZeusWeb application at the vulnerable URL path

How to Mitigate CVE-2025-13650

Immediate Actions Required

• Upgrade ZeusWeb to a patched version if available from Microcom
• Implement server-side input validation to reject or sanitize HTML and JavaScript in all form fields
• Apply output encoding (HTML entity encoding) when rendering user-supplied data
• Deploy Content Security Policy headers with strict-dynamic or nonce-based script restrictions
• Review existing user accounts for malicious content in the Surname field and sanitize if necessary

Patch Information

No vendor patch has been confirmed at this time. Organizations should contact Microcom directly for security updates regarding ZeusWeb version 6.1.31. Monitor the Microcom Zeus Service Portal and Microcom360 Zeus Web Service pages for official security advisories.

Workarounds

• Implement a Web Application Firewall (WAF) with XSS filtering rules in front of the ZeusWeb application
• Add server-side input validation to strip or reject any input containing HTML tags or JavaScript
• Apply output encoding at the application level using security libraries appropriate for your framework
• Restrict access to the account creation functionality to trusted networks or require additional verification
• Consider disabling the self-registration feature until a patch is available if business operations permit

# Example WAF rule configuration (ModSecurity)
# Block common XSS patterns in form submissions
SecRule ARGS "@rx <script" "id:1001,phase:2,deny,status:403,msg:'XSS Attack Detected'"
SecRule ARGS "@rx javascript:" "id:1002,phase:2,deny,status:403,msg:'XSS Attack Detected'"
SecRule ARGS "@rx onerror=" "id:1003,phase:2,deny,status:403,msg:'XSS Attack Detected'"