CVE-2026-7026

Vulnerability

Analysis

The D-Link DGS-3420 switch firmware version 1.50.018 contains a cross-site scripting (XSS) vulnerability in the System Information Settings page. The component fails to sanitize user-supplied input to the 'System Name' argument, allowing an attacker to inject arbitrary web scripts or HTML. This flaw occurs when the system name is stored and later rendered in administrative interface pages without proper escaping [1].

Attack

Vector

An attacker can exploit this vulnerability remotely without requiring authentication, as the System Name field can be set on the unauthenticated configuration page. The manipulated argument triggers stored XSS, meaning the injected payload executes whenever an administrator views the System Information page. Public exploit code is available, lowering the barrier for exploitation [1].

Impact

Successful exploitation allows the attacker to execute malicious scripts in the browser of an authenticated administrator. This could lead to session hijacking, defacement of the management interface, or theft of sensitive configuration data. The CVSS v3 base score of 4.5 indicates a medium severity, reflecting the need for user interaction but significant potential for lateral movement within the network [1].

Mitigation

As of the publication date, D-Link has not released a patch for this vulnerability. Users are advised to restrict access to the management interface via firewall rules or VLAN segmentation, and to monitor for firmware updates from the vendor. The vulnerability is publicly disclosed and should be treated as an active risk [1].