CVE-2025-13651: Microcom360 Zeusweb Info Disclosure Flaw

CVE-2025-13651 Overview

CVE-2025-13651 is an information disclosure vulnerability in Microcom ZeusWeb version 6.1.31. The flaw exposes sensitive system information to unauthorized network actors, enabling web application fingerprinting. Attackers can query the application remotely without authentication and gather details that aid in reconnaissance and follow-on exploitation. The issue is tracked under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

Critical Impact
Unauthenticated remote attackers can fingerprint the ZeusWeb application and obtain sensitive system information, accelerating reconnaissance against the target environment.

Affected Products

Microcom360 ZeusWeb 6.1.31
Microcom Zeus Web Service deployments running the affected build
Internet-exposed ZeusWeb portals (for example, the Zeus Microcom Service Portal)

Discovery Timeline

2026-02-11 - CVE-2025-13651 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2025-13651

Vulnerability Analysis

The vulnerability resides in how ZeusWeb 6.1.31 responds to unauthenticated HTTP requests. The application returns metadata that identifies product, version, and underlying technology stack details. This information enables web application fingerprinting, a reconnaissance technique used to map software versions to known weaknesses.

The flaw is network-reachable and requires no privileges or user interaction. Confidentiality of system information is affected, while integrity and availability remain unchanged. Public technical references are available on the HackrTU advisory for CVE-2025-13651 and the related HRTU-0001 disclosure.

Root Cause

The root cause is improper handling of system information in HTTP responses and exposed application surfaces. ZeusWeb discloses version banners, technology indicators, or descriptive error content that should remain internal. This maps to [CWE-497], which covers exposure of sensitive system information to unauthorized actors.

Attack Vector

An unauthenticated remote attacker sends standard HTTP or HTTPS requests to a ZeusWeb instance. The server returns identifying information in response headers, body content, or default pages. The attacker uses these indicators to confirm software identity and version, then pivots to targeted exploitation if vulnerable components are present.

No verified exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microcom 360 Zeus Service Overview for product context.

Detection Methods for CVE-2025-13651

Indicators of Compromise

Repeated unauthenticated HTTP/HTTPS requests to ZeusWeb endpoints from a single source IP within short time windows
Requests targeting common fingerprinting paths such as /, /login, /robots.txt, and error-generating URLs
User-Agent strings associated with scanners such as Nmap, Nikto, WhatWeb, or wappalyzer
Outbound responses containing version banners or technology identifiers leaving ZeusWeb hosts

Detection Strategies

Inspect web server access logs for high-volume reconnaissance patterns against ZeusWeb hosts on TCP/4040 and other exposed ports
Deploy web application firewall (WAF) rules that flag fingerprinting tools and known scanner signatures
Correlate scanning activity with subsequent authentication attempts to detect reconnaissance-to-exploitation pivots
Review HTTP responses for unnecessary disclosure of Server, X-Powered-By, and version metadata

Monitoring Recommendations

Forward ZeusWeb HTTP access and error logs to a centralized SIEM for retention and correlation
Alert on anomalous request rates and User-Agent diversity targeting ZeusWeb-facing assets
Monitor external attack surface inventories for newly exposed ZeusWeb instances and version banners

How to Mitigate CVE-2025-13651

Immediate Actions Required

Inventory all Microcom ZeusWeb deployments and confirm whether version 6.1.31 is in use
Restrict access to ZeusWeb administrative interfaces using network ACLs or VPN gating
Contact Microcom360 for an updated build that addresses CVE-2025-13651
Remove or suppress version banners and verbose error messages where the application permits configuration

Patch Information

No vendor patch URL is listed in the NVD record at the time of publication. Administrators should monitor the Microcom 360 product page and reach out to the vendor for remediation guidance specific to ZeusWeb 6.1.31. Review the HackrTU advisory for ongoing coordination updates.

Workarounds

Place ZeusWeb behind a reverse proxy or WAF that strips identifying response headers such as Server and X-Powered-By
Block direct internet exposure of ZeusWeb management ports and require authenticated access through a VPN
Configure custom error pages to remove stack traces, framework names, and version strings
Rate-limit unauthenticated requests at the perimeter to slow large-scale fingerprinting attempts

bash

# Example reverse proxy configuration to suppress fingerprinting indicators (NGINX)
server {
    listen 443 ssl;
    server_name zeusweb.example.com;

    # Remove identifying headers from upstream responses
    proxy_hide_header Server;
    proxy_hide_header X-Powered-By;
    more_clear_headers 'Server' 'X-Powered-By';

    # Custom generic error pages
    error_page 400 401 403 404 500 502 503 504 /generic_error.html;

    # Restrict access to known corporate ranges
    allow 10.0.0.0/8;
    deny all;

    location / {
        proxy_pass https://zeusweb-backend:4040;
    }
}