CVE-2025-13589

Vulnerability

Analysis

FMS, developed by Otsuka Information Technology, contains a reflected Cross-site Scripting (XSS) vulnerability [1][2]. The flaw arises from improper sanitization of user input in the application, enabling attackers to inject arbitrary JavaScript code into web pages [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by crafting a malicious link and tricking a user into clicking it (phishing) [1][2]. No authentication is required, and the attack is conducted over the network with low complexity [2]. The user interaction is required, as the victim must click the crafted URL [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the context of the vulnerable application [1]. This can lead to session hijacking, data theft, or other malicious actions as the attacker can manipulate the web page content and steal sensitive information [1][2].

Mitigation

The vulnerability affects FMS version 20251014.10r45111 and earlier [2]. Users are advised to update to version 20251020.18r45177 or later, which contains the fix [2].