# Leviton AcquiSuite XSS allows session hijacking

Published: 2025-07-17 · Severity: routine · Sectors: energy, telecommunications
Canonical: https://vorant.io/reports/94824515-4e66-58da-8248-79d135bcd0ff/leviton-acquisuite-xss-allows-session-hijacking

> Cross-site scripting in Leviton energy monitoring products allows remote attackers to steal sessions and control the service.

Leviton AcquiSuite (version A8810) and Energy Monitoring Hub (version A8812) contain a reflected cross-site scripting vulnerability (CVE-2025-6185) in URL parameter handling. An attacker can craft a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the victim's browser, stealing session tokens and gaining control of the affected service. The vulnerability requires user interaction (clicking a link) and network access to the device, but has low attack complexity and affects critical infrastructure in the communications sector worldwide.

Leviton has not engaged with CISA on mitigation, and no fix is currently available. CISA reports no known active exploitation in the wild at this time. Defenders should minimize network exposure by keeping these devices off the internet, placing them behind firewalls isolated from business networks, and using VPNs for required remote access. Organizations should assess the risk of running affected versions and contact Leviton support for patching guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2025-6185

## Detection guidance (public sample)

### Reflected XSS Payload in Web Server Request Query String

ATT&CK: T1190

Web server logs show script-injection markers such as script/svg tags, event handlers or javascript: URIs in the query string, as used in reflected XSS against embedded web UIs like Leviton AcquiSuite. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reflected XSS Payload in Web Server Request Query String
description: 'Detects HTTP requests whose query string carries HTML/JavaScript injection
  markers (script/svg/img tags, inline event handlers, javascript: URIs), as used
  for reflected XSS against embedded device web interfaces such as Leviton AcquiSuite
  (CVE-2025-6185). Matches the generic payload pattern, not a specific parameter name.'
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_tag:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - <svg
    - '%3Csvg'
    - <img
    - '%3Cimg'
    - <iframe
    - '%3Ciframe'
    - 'javascript:'
  selection_handler:
    cs-uri-query|contains:
    - onerror=
    - onload=
    - onmouseover=
    - onfocus=
  condition: 1 of selection_*
falsepositives:
- Authorized web vulnerability scanners or penetration tests against the device
- Web applications that legitimately accept HTML content in query parameters
level: medium
id: 3b864f08-5252-52db-921c-dca5a6582951
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
```

### XSS Session Token Theft Payload in Requested URL

ATT&CK: T1185

Proxy logs show URLs combining script injection with access to cookies or web storage, indicating a crafted link meant to steal session tokens. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: XSS Session Token Theft Payload in Requested URL
description: Detects URLs that combine a script-injection marker with access to document.cookie
  or browser storage, consistent with a crafted reflected-XSS link used to steal session
  tokens and hijack a session (for example against Leviton AcquiSuite).
tags:
- attack.collection
- attack.t1185
- attack.reconnaissance
- attack.t1598.003
logsource:
  category: proxy
detection:
  selection_script:
    c-uri|contains:
    - <script
    - '%3Cscript'
    - 'javascript:'
    - onerror=
    - onload=
  selection_theft:
    c-uri|contains:
    - document.cookie
    - document%2ecookie
    - localStorage
    - sessionStorage
  condition: selection_script and selection_theft
falsepositives:
- Security awareness training or red-team exercises using XSS test links
- Developer documentation or bug-tracker URLs that embed example XSS code
level: high
id: 9acff6c4-3b74-5917-bebe-99506d69fc70
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/94824515-4e66-58da-8248-79d135bcd0ff/leviton-acquisuite-xss-allows-session-hijacking.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup