CVE-2026-102258: XSS
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).
Affected Software
Event History
Frequently Asked Questions
What access level does the vulnerability description identify for an attacker?
The description identifies a remote authenticated attacker with administrator access to the Appliance Management Console. However, the supplied CVSS vector lists PR:N, so the provided data contains conflicting information about whether privileges are required.
Is user interaction required for exploitation?
The supplied CVSS vector includes UI:R, indicating that user interaction is required.
What impact is indicated by the supplied CVSS data?
The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. It also indicates a scope change (S:C).