CVE-2025-15505: XSS in Luxul XWR-600 Web Interface

Successful exploitation of CVE-2025-15505 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Luxul XWR-600's web interface. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the administration interface. Given the device's role as a network router, a compromised administrator interface could provide an attacker with access to sensitive network configuration data, potentially enabling further attacks against internal resources. The public availability of a proof-of-concept significantly increases the risk of exploitation.

1. Reserved2026-01-10
2. Published2026-01-11
3. Modified2026-02-23
4. EPSS updated2026-03-23

While a patch is not yet available from Luxul, immediate mitigation steps are crucial. Consider temporarily disabling the Guest Network feature if it's not essential. Implement strict input validation and output encoding on the Web Administration Interface to prevent XSS attacks. Web application firewalls (WAFs) can be configured to filter out malicious JavaScript payloads targeting the SSID parameter. Monitor network traffic for suspicious activity and unusual requests to the web interface. After a patch is released by Luxul, promptly upgrade the XWR-600 to the fixed version and verify the fix by attempting to inject a simple XSS payload into the Guest Network/Wireless Profile SSID field.