Stored Cross-Site Scripting Flaw in Leica Geosystems GNSS Products
CVE-2018-25131

5.1MEDIUM

Key Information:

Vendor

Leica Geosystems Ag

Status
Gr10/gr25/gr30/gr50 Gnss
Vendor
CVE Published:
24 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25131?

Leica Geosystems' GNSS products, specifically versions GR10, GR25, GR30, and GR50 running 4.30.063, are vulnerable to a stored cross-site scripting attack through their configuration file upload feature. This vulnerability allows attackers to upload a malicious HTML file, resulting in arbitrary JavaScript being executed within an unsuspecting user's browser session when they access the compromised file. This can lead to unauthorized actions on behalf of the user, compromising sensitive information or sessions.

Affected Version(s)

GR10/GR25/GR30/GR50 GNSS 4.30.063

GR10/GR25/GR30/GR50 GNSS 4.20.232

GR10/GR25/GR30/GR50 GNSS 4.11.606

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25131 - Proof of Concept

References

https://www.exploit-db.com/exploits/46091
exploit
https://www.leica-geosystems.com
product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-55...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2018-25131 : Stored Cross-Site Scripting Flaw in Leica Geosystems GNSS Products