CVE-2025-13651: Microcom ZeusWeb Info Disclosure Flaw

CVE-2025-13651 Overview

CVE-2025-13651 is an Exposure of Sensitive System Information to an Unauthorized Actor vulnerability affecting Microcom ZeusWeb. This security flaw allows attackers to perform Web Application Fingerprinting, potentially exposing sensitive system data to unauthorized parties. The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

Critical Impact

Unauthorized attackers can remotely gather sensitive system information from ZeusWeb installations without authentication, enabling reconnaissance activities that could facilitate further attacks against the affected infrastructure.

Affected Products

• Microcom ZeusWeb version 6.1.31

Discovery Timeline

• February 11, 2026 - CVE-2025-13651 published to NVD
• February 11, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13651

Vulnerability Analysis

This vulnerability allows remote unauthenticated attackers to extract sensitive system information from Microcom ZeusWeb installations. The flaw enables web application fingerprinting techniques that can reveal configuration details, software versions, and other system metadata that should not be accessible to external parties. Such information disclosure can serve as a valuable reconnaissance tool for attackers planning more sophisticated attacks against the target environment.

The vulnerability affects the confidentiality of the system by exposing low-severity information without requiring any user interaction or authentication. While the direct impact is limited to information disclosure, the gathered intelligence could be leveraged in subsequent attack stages.

Root Cause

The root cause stems from improper handling of sensitive system information exposure (CWE-497). Microcom ZeusWeb version 6.1.31 fails to adequately restrict access to system metadata and configuration information, allowing unauthorized actors to enumerate and fingerprint the web application. This typically occurs when error messages, HTTP headers, or application responses inadvertently reveal internal system details that should be protected from external access.

Attack Vector

The attack vector is network-based, allowing remote exploitation without any prerequisites. An attacker can exploit this vulnerability by:

1. Sending crafted HTTP requests to the ZeusWeb application
2. Analyzing response headers, error messages, or application behavior
3. Extracting sensitive system information from the exposed data
4. Using gathered intelligence to map the target environment and plan further attacks

The exploitation requires no authentication or user interaction, making it particularly accessible for reconnaissance activities. For detailed technical information about the vulnerability, refer to the HackRTU security advisory.

Detection Methods for CVE-2025-13651

Indicators of Compromise

• Unusual volumes of HTTP requests targeting specific endpoints known to leak system information
• Reconnaissance traffic patterns from external IP addresses probing for version strings or configuration data
• Repeated requests designed to trigger error messages that may expose system details

Detection Strategies

• Monitor web server logs for suspicious fingerprinting activities and enumeration attempts
• Implement web application firewall (WAF) rules to detect and block common fingerprinting techniques
• Deploy SentinelOne Singularity Platform to identify anomalous network behavior associated with reconnaissance activities
• Review HTTP responses for unintentional information leakage in headers or error messages

Monitoring Recommendations

• Enable detailed logging on ZeusWeb instances to capture all incoming requests
• Establish baseline traffic patterns and alert on deviations indicative of enumeration attacks
• Integrate security monitoring with SIEM solutions to correlate fingerprinting attempts across multiple assets
• Regularly audit web application responses to ensure sensitive system information is not exposed

How to Mitigate CVE-2025-13651

Immediate Actions Required

• Identify all Microcom ZeusWeb 6.1.31 installations in your environment
• Restrict network access to ZeusWeb instances using firewall rules and network segmentation
• Review and harden server configurations to minimize information disclosure
• Monitor for suspicious reconnaissance activity targeting affected systems

Patch Information

Organizations should contact Microcom directly for patch availability and upgrade guidance. Review the Microcom ZeusWeb service page for official vendor communications regarding security updates. Additional technical details are available from the HackRTU advisory.

Workarounds

• Configure custom error pages that suppress detailed system information
• Remove or sanitize HTTP response headers that reveal software versions or internal details
• Implement a reverse proxy or WAF to filter sensitive information from outbound responses
• Apply network-level access controls to limit exposure of ZeusWeb to trusted networks only

# Example: Configure web server to suppress version information
# Apache configuration
ServerTokens Prod
ServerSignature Off

# Nginx configuration
server_tokens off;