A stored cross-site scripting vulnerability in Leica Geosystems GR series GNSS receivers allows an authenticated attacker to execute arbitrary malicious code in a user's browser session.

The application is susceptible to a stored cross-site scripting (XSS) flaw triggered by improper neutralization of user-supplied input during the configuration file upload process. An attacker with low-level access can upload a malicious HTML or JavaScript file, which is then stored on the device and executed when viewed by a user.

Successful exploitation of this vulnerability could lead to unauthorized actions performed on behalf of an administrator or other users, including session hijacking or the theft of sensitive configuration data. While the CVSS score of 7.2 reflects a significant risk, the requirement for authenticated access limits the initial attack surface to users who have already gained a foothold within the management interface.

Immediate Action: Update the affected Leica Geosystems GNSS receiver firmware to the latest version provided by the manufacturer to remediate the insecure file upload handling.

Proactive Monitoring: Review device access logs for unusual file upload activity or unauthorized modifications to the configuration settings.

Compensating Controls: Implement a Web Application Firewall (WAF) or restrict access to the device management interface to trusted administrative IP addresses to prevent unauthorized users from reaching the vulnerable upload endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit Database (EDB-ID 46091).

Given the availability of a functional proof-of-concept, administrators should prioritize updating all affected Leica GR series receivers. Failure to patch these devices leaves the management interface open to potential session compromise, which could jeopardize the integrity of the GNSS reference station operations.