CVE-2026-70382: Stored Cross-Site Scripting in Web Interface
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Event History
Frequently Asked Questions
What access and conditions are required for exploitation?
The attacker must have low-level privileges and be able to influence a value that the device stores. Exploitation also requires a user to view a web-interface page that renders the affected value, and the attack can be delivered over the network.
What impact is reflected in the severity assessment?
The supplied vector indicates no direct confidentiality or integrity impact and a low availability impact. It also indicates changed scope, meaning the effect may extend beyond the vulnerable component's original security authority.