Luxul XWR-600 Web Administration cross site scripting

Successful exploitation of CVE-2025-15505 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Luxul XWR-600's web interface. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the administration interface. Given the device's role as a network router, a compromised administrator interface could provide an attacker with access to sensitive network configuration data, potentially enabling further attacks against internal resources. The public availability of a proof-of-concept significantly increases the risk of exploitation.

Organizations using Luxul XWR-600 routers, particularly those relying on the Guest Network feature for external access, are at risk. Shared hosting environments where multiple users share the same router configuration are also vulnerable. Legacy configurations with default passwords or outdated firmware are especially susceptible.

• windows / supply-chain: Monitor PowerShell execution for suspicious commands related to network configuration or web interface access. Check scheduled tasks for unusual scripts. • linux / server: Examine system logs (journalctl) for unusual HTTP requests targeting the web administration interface. Use lsof to identify processes accessing the web interface. • generic web: Use curl to test the Guest Network/Wireless Profile SSID parameter for XSS vulnerabilities. Inspect access and error logs for suspicious requests. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability does not directly impact databases. • other: Monitor network traffic for unusual HTTP requests to the XWR-600's web interface, particularly those involving the Guest Network/Wireless Profile SSID parameter.

1. 2026-01-11Disclosure

   disclosure

1. Gereserveerd2026-01-10
2. Gepubliceerd2026-01-11
3. Gewijzigd2026-02-23
4. EPSS bijgewerkt2026-03-23

While a patch is not yet available from Luxul, immediate mitigation steps are crucial. Consider temporarily disabling the Guest Network feature if it's not essential. Implement strict input validation and output encoding on the Web Administration Interface to prevent XSS attacks. Web application firewalls (WAFs) can be configured to filter out malicious JavaScript payloads targeting the SSID parameter. Monitor network traffic for suspicious activity and unusual requests to the web interface. After a patch is released by Luxul, promptly upgrade the XWR-600 to the fixed version and verify the fix by attempting to inject a simple XSS payload into the Guest Network/Wireless Profile SSID field.