Leviton AcquiSuite XSS allows session hijacking
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Cross-site scripting in Leviton energy monitoring products allows remote attackers to steal sessions and control the service.
Leviton AcquiSuite (version A8810) and Energy Monitoring Hub (version A8812) contain a reflected cross-site scripting vulnerability (CVE-2025-6185) in URL parameter handling. An attacker can craft a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the victim's browser, stealing session tokens and gaining control of the affected service. The vulnerability requires user interaction (clicking a link) and network access to the device, but has low attack complexity and affects critical infrastructure in the communications sector worldwide.
Leviton has not engaged with CISA on mitigation, and no fix is currently available. CISA reports no known active exploitation in the wild at this time. Defenders should minimize network exposure by keeping these devices off the internet, placing them behind firewalls isolated from business networks, and using VPNs for required remote access. Organizations should assess the risk of running affected versions and contact Leviton support for patching guidance.
Mentioned in this report
Detection guidance
Reflected XSS Payload in Web Server Request Query String
Web server logs show script-injection markers such as script/svg tags, event handlers or javascript: URIs in the query string, as used in reflected XSS against embedded web UIs like Leviton AcquiSuite. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Payload in Web Server Request Query String
description: 'Detects HTTP requests whose query string carries HTML/JavaScript injection
markers (script/svg/img tags, inline event handlers, javascript: URIs), as used
for reflected XSS against embedded device web interfaces such as Leviton AcquiSuite
(CVE-2025-6185). Matches the generic payload pattern, not a specific parameter name.'
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_tag:
cs-uri-query|contains:
- <script
- '%3Cscript'
- <svg
- '%3Csvg'
- <img
- '%3Cimg'
- <iframe
- '%3Ciframe'
- 'javascript:'
selection_handler:
cs-uri-query|contains:
- onerror=
- onload=
- onmouseover=
- onfocus=
condition: 1 of selection_*
falsepositives:
- Authorized web vulnerability scanners or penetration tests against the device
- Web applications that legitimately accept HTML content in query parameters
level: medium
id: 3b864f08-5252-52db-921c-dca5a6582951
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
XSS Session Token Theft Payload in Requested URL
Proxy logs show URLs combining script injection with access to cookies or web storage, indicating a crafted link meant to steal session tokens. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XSS Session Token Theft Payload in Requested URL
description: Detects URLs that combine a script-injection marker with access to document.cookie
or browser storage, consistent with a crafted reflected-XSS link used to steal session
tokens and hijack a session (for example against Leviton AcquiSuite).
tags:
- attack.collection
- attack.t1185
- attack.reconnaissance
- attack.t1598.003
logsource:
category: proxy
detection:
selection_script:
c-uri|contains:
- <script
- '%3Cscript'
- 'javascript:'
- onerror=
- onload=
selection_theft:
c-uri|contains:
- document.cookie
- document%2ecookie
- localStorage
- sessionStorage
condition: selection_script and selection_theft
falsepositives:
- Security awareness training or red-team exercises using XSS test links
- Developer documentation or bug-tracker URLs that embed example XSS code
level: high
id: 9acff6c4-3b74-5917-bebe-99506d69fc70
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs