CVE-2021-35956

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the embedded webserver of AKCP sensorProbe devices prior to firmware version SP480-20210624. The vulnerability affects the Sensor Description, Email (from/to/cc), System Name, and System Location fields, which do not properly sanitize user input [1].

Exploitation

An attacker must have valid authenticated access to the sensorProbe web interface. The attacker can then inject arbitrary JavaScript into any of the vulnerable fields. When an administrator or other user views the affected page, the injected script executes in the context of the victim's session [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information. The attack is persistent (stored) and affects all users who view the injected content [1].

Mitigation

AKCP has released firmware version SP480-20210624 to address this vulnerability. All users should update to this version or later. No workarounds are documented; updating is the recommended solution [1].