CVE-2025-6185
CRITICALLeviton AcquiSuite and Energy Monitoring Hub - Cross-Site Scripting via URL Parameter
Title source: llmDescription
Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service.
References (2)
Core 2
Core References
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
Various Sources
https://leviton.com/support/resources/product-support
Scores
CVSS v3
9.3
EPSS
0.0033
EPSS Percentile
24.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-79
Status
published
Products (2)
Leviton/AcquiSuite
Version A8810
Leviton/Energy Monitoring Hub
Version A8812
Published
Jul 18, 2025
Tracked Since
Feb 18, 2026