PT-2025-6040 · Kelio · Kelio Visio 1+2

Ismael Pacheco Torrecilla · Published 2025-02-10 · Updated 2025-02-10 · CVE-2025-1175

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kelio Visio 1 versions 3.2C through 5.1K Kelio Visio X7 versions 3.2C through 5.1K Kelio Visio X4 versions 3.2C through 5.1K

Description The issue is a Reflected Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute a JavaScript payload by making a POST request and injecting malicious code into the editable username parameter of the "/PageLoginVisio.do" endpoint.

Recommendations For Kelio Visio 1 versions 3.2C through 5.1K, consider disabling the editable username parameter in the "/PageLoginVisio.do" endpoint until a patch is available. For Kelio Visio X7 versions 3.2C through 5.1K, restrict access to the "/PageLoginVisio.do" endpoint to minimize the risk of exploitation. For Kelio Visio X4 versions 3.2C through 5.1K, avoid using the username parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1175

Affected Products

Kelio Visio 1

Kelio Visio X4

Kelio Visio X7

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-1175 · Security Note
• https://twitter.com/CVEnew/status/1888941879259017543 · Twitter Post
• https://t.me/cvenotify/110535 · Telegram Post
• https://t.me/cvedetector/17552 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-kelio-visio · Note
• https://twitter.com/WolfgangSesin/status/1888946917742117215 · Twitter Post