Stored XSS Vulnerability in OZW Web Servers Before V5.2

An authenticated attacker can inject malicious JavaScript into the OZW672/OZW772 web interface that executes when other authorized users (especially administrators) access the system, potentially allowing them to perform unauthorized actions or capture credentials.

Water and electric utilities using OZW672 or OZW772 web servers for SCADA or process management interfaces. Operators, engineers, and administrators who access these web portals are at risk if lower-privileged technicians or contractors are also granted access.

An attacker with valid credentials logs into the OZW web interface and injects malicious JavaScript through input fields (such as configuration parameters or data entry forms). When another authenticated user—particularly an administrator with higher privileges—views the compromised page, the injected code executes in their browser session, allowing the attacker to perform actions as that higher-privileged user.