CVE-2025-13651 - Vulnerability Details - OpenCVE

Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microcom	Zeusweb

No data.

No data.

References

Link	Providers
https://www.hackrtu.com/blog/CNA-CVE-2025-13651/
https://www.hackrtu.com/blog/CNA-HRTU-0001/
https://www.microcom360.com/servicio-zeus-web/
https://zeus.microcom.es:4040/

History

Wed, 11 Feb 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31.
Title		LEAK OF SENSITIVE INFORMATION ON MICROCOM'S ZEUSWEB
First Time appeared		Microcom Microcom zeusweb
Weaknesses		CWE-497
CPEs		cpe:2.3:a:microcom:zeusweb:6.1.31:::::::*
Vendors & Products		Microcom Microcom zeusweb
References		https://www.hackrtu.com/blog/CNA-CVE-2025-13651/ https://www.hackrtu.com/blog/CNA-HRTU-0001/ https://www.microcom360.com/servicio-zeus-web/ https://zeus.microcom.es:4040/
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: HackRTU

Published: 2026-02-11T09:06:09.297Z

Updated: 2026-02-11T09:06:09.297Z

Reserved: 2025-11-25T09:45:49.686Z

Link: CVE-2025-13651

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-02-11T09:15:50.303

Modified: 2026-02-11T09:15:50.303

Link: CVE-2025-13651

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13651", "assignerOrgId": "ffb98d57-deaa-4918-a669-5225ccc13e39", "state": "PUBLISHED", "assignerShortName": "HackRTU", "dateReserved": "2025-11-25T09:45:49.686Z", "datePublished": "2026-02-11T09:06:09.297Z", "dateUpdated": "2026-02-11T09:06:09.297Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "ZeusWeb", "vendor": "Microcom", "versions": [{"status": "affected", "version": "6.1.31"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microcom:zeusweb:6.1.31:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Aar\u00f3n Flecha Men\u00e9ndez"}, {"lang": "en", "type": "finder", "value": "V\u00edctor Bello Cuevas"}], "datePublic": "2026-02-11T09:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31."}], "value": "Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31."}], "impacts": [{"capecId": "CAPEC-224", "descriptions": [{"lang": "en", "value": "CAPEC-224 Fingerprinting"}]}, {"capecId": "CAPEC-541", "descriptions": [{"lang": "en", "value": "CAPEC-541 Application Fingerprinting"}]}, {"capecId": "CAPEC-170", "descriptions": [{"lang": "en", "value": "CAPEC-170 Web Application Fingerprinting"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ffb98d57-deaa-4918-a669-5225ccc13e39", "shortName": "HackRTU", "dateUpdated": "2026-02-11T09:06:09.297Z"}, "references": [{"tags": ["technical-description", "patch"], "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001/"}, {"tags": ["technical-description", "patch"], "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13651/"}, {"tags": ["product"], "url": "https://www.microcom360.com/servicio-zeus-web/"}, {"tags": ["product"], "url": "https://zeus.microcom.es:4040/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The provider has implement the new version 6.2.5 which solves the security problems detected in the previous version. The end user does not need to perform any update actions, as the software is cloud-based and managed by the provider, who has implemented the new version for all users."}], "value": "The provider has implement the new version\u00a06.2.5 which solves the security problems detected in the previous version. The end user does not need to perform any update actions, as the software is cloud-based and managed by the provider, who has implemented the new version for all users."}], "source": {"advisory": "HRTU#0001", "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2025-11-06T11:00:00.000Z", "value": "Vulnerability detection by the researchers"}, {"lang": "en", "time": "2025-11-11T11:00:00.000Z", "value": "Report from researchers to the CNA of HackRTU"}, {"lang": "en", "time": "2025-11-12T15:00:00.000Z", "value": "Report from HackRTU CNA to the provider"}, {"lang": "en", "time": "2026-02-11T09:10:00.000Z", "value": "Vulnerabilities published by HackRTU's CNA"}], "title": "LEAK OF SENSITIVE INFORMATION ON MICROCOM'S ZEUSWEB", "x_generator": {"engine": "Vulnogram 0.5.0"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31."}], "id": "CVE-2025-13651", "lastModified": "2026-02-11T09:15:50.303", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ffb98d57-deaa-4918-a669-5225ccc13e39", "type": "Secondary"}]}, "published": "2026-02-11T09:15:50.303", "references": [{"source": "ffb98d57-deaa-4918-a669-5225ccc13e39", "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13651/"}, {"source": "ffb98d57-deaa-4918-a669-5225ccc13e39", "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001/"}, {"source": "ffb98d57-deaa-4918-a669-5225ccc13e39", "url": "https://www.microcom360.com/servicio-zeus-web/"}, {"source": "ffb98d57-deaa-4918-a669-5225ccc13e39", "url": "https://zeus.microcom.es:4040/"}], "sourceIdentifier": "ffb98d57-deaa-4918-a669-5225ccc13e39", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "ffb98d57-deaa-4918-a669-5225ccc13e39", "type": "Secondary"}]}