CVE-2025-4411: Dataprom PACS-ACSS XSS Vulnerability

CVE-2025-4411 Overview

CVE-2025-4411 is a Cross-Site Scripting (XSS) vulnerability affecting Dataprom Informatics PACS-ACSS. The flaw stems from improper neutralization of user input during web page generation, classified under [CWE-79]. Attackers can inject malicious script content that executes in the context of a victim's browser session.

The issue affects PACS-ACSS versions released before 16.05.2025. The vulnerability is network-accessible and requires no authentication or user interaction to trigger, though impact is limited to confidentiality and availability at low levels.

Critical Impact
Attackers can execute arbitrary JavaScript in authenticated user sessions, enabling session data theft and unauthorized actions within the PACS-ACSS web interface.

Affected Products

Dataprom Informatics PACS-ACSS versions before 16.05.2025
Physical Access Control and Security Systems (PACS-ACSS) web management interface
Deployments exposing the PACS-ACSS interface to untrusted networks

Discovery Timeline

2025-07-23 - CVE-2025-4411 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4411

Vulnerability Analysis

The vulnerability exists in the PACS-ACSS web application, which fails to sanitize user-supplied input before reflecting it into rendered HTML output. This behavior enables Cross-Site Scripting (XSS) attacks against authenticated administrators and operators of the physical access control system.

Because PACS-ACSS manages physical access to facilities, successful exploitation carries operational implications beyond typical web application XSS. Attackers can hijack operator sessions, manipulate the interface visible to legitimate users, or trigger unauthorized administrative actions.

The vulnerability is remotely reachable and does not require prior authentication or user interaction, according to the assigned CVSS vector. Confidentiality and availability impacts are rated low, while integrity impact is rated none.

Root Cause

The root cause is improper neutralization of input during web page generation, mapped to [CWE-79]. The application processes user-controlled data and includes it in HTTP responses without applying context-appropriate output encoding or input validation, allowing script content to be interpreted by the browser.

Attack Vector

An attacker crafts a URL or request containing malicious JavaScript payloads targeting a vulnerable PACS-ACSS endpoint. When a user loads the resulting page, the browser executes the injected script under the origin of the PACS-ACSS application. This grants the attacker access to cookies, session tokens, and the ability to issue authenticated requests on the victim's behalf.

The vulnerability mechanism is documented in the Turkish national CSIRT advisory. See the USOM Notification TR-25-0171 and Siber Güvenlik Notification TR-25-0171 for the coordinating disclosure record.

Detection Methods for CVE-2025-4411

Indicators of Compromise

HTTP request parameters or URL fragments containing <script>, javascript:, or event-handler attributes such as onerror= and onload= directed at PACS-ACSS endpoints
Unexpected outbound requests from operator browsers to attacker-controlled domains after visiting PACS-ACSS pages
Web server logs showing repeated requests with encoded payloads such as %3Cscript%3E targeting reflected input parameters

Detection Strategies

Deploy web application firewall (WAF) rules that identify reflected XSS patterns in requests to the PACS-ACSS host
Correlate operator authentication events with anomalous administrative actions performed within short intervals
Inspect referrer and origin headers on PACS-ACSS traffic to identify unusual cross-origin navigation sequences

Monitoring Recommendations

Enable verbose HTTP access logging on the PACS-ACSS server, including full query strings and POST bodies where privacy policy permits
Alert on Content Security Policy (CSP) violation reports if CSP is deployed in front of the application
Monitor session activity for concurrent logins from disparate IP addresses, which may indicate cookie theft

How to Mitigate CVE-2025-4411

Immediate Actions Required

Upgrade PACS-ACSS to the version released on or after 16.05.2025 that addresses this XSS vulnerability
Restrict network access to the PACS-ACSS management interface to trusted administrative networks and VPN segments
Force session invalidation and require re-authentication for all PACS-ACSS operator accounts after patching

Patch Information

Dataprom Informatics addressed the issue in PACS-ACSS builds released after 16.05.2025. Administrators should coordinate with the vendor to obtain the fixed release and verify version metadata after installation. The advisory record is tracked in USOM Notification TR-25-0171.

Workarounds

Place the PACS-ACSS interface behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts
Configure a WAF to filter requests containing common XSS payloads directed at PACS-ACSS URLs
Restrict browser access to the application to dedicated management workstations that do not browse the general internet

bash

# Example nginx reverse-proxy hardening for PACS-ACSS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;