Description

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-01T21:18:44.847Z",
  "pubdate": "2026-09-01T21:18:44.847Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the web-based management interface of AOS-CX switches. This security flaw allows an unauthenticated remote attacker to perform unauthorized state-changing operations on behalf of an authenticated administrator session.\nThe vulnerability arises from insufficient CSRF protection mechanisms within the management interface, enabling the execution of arbitrary inputs. An attacker can manipulate an authenticated user into visiting a malicious, crafted URL, which then triggers unintended requests toward the target switch. The risk to the organization is high, as successful exploitation may result in unauthorized configuration changes, service disruption, or full administrative compromise of the networking device.\nExploitation requires the attacker to successfully lure a logged-in user into interacting with malicious content. Once the request is executed, the switch processes the input as legitimate because it lacks the necessary anti-CSRF tokens or origin validation to verify the user's intent. This vulnerability highlights a critical failure in session integrity enforcement within the management plane of the affected AOS-CX products.",
  "technicalDetails": "The core of the vulnerability is the absence of robust Cross-Site Request Forgery (CSRF) mitigation strategies—such as unique, cryptographically strong anti-CSRF tokens—within the HTTP request handling logic of the AOS-CX web management interface.\nIn a standard CSRF attack flow, the victim must hold an active session within the administrative web interface. The attacker hosts a malicious document or script on an external site that the victim visits while the management session remains active. The crafted request, which could be an HTML form submission or a JavaScript fetch/XHR call, is automatically accompanied by the victim's browser-stored cookies or session tokens. Because the AOS-CX interface fails to validate the 'Origin' or 'Referer' headers, or verify a per-session token, the web server processes the attacker's request as an intentional action initiated by the authorized administrator.\nThe attack vector is characterized as remote and unauthenticated from the perspective of the attacker, though it requires an intermediary victim to complete the 'confused deputy' chain of action. Upon successful execution, the interface processes the arbitrary input—such as command execution, user account modification, or configuration updates—as if they originated from the legitimate dashboard. The impact is significant, as it bypasses the intended access control policies by leveraging the authenticated state of the session.\nThis vulnerability persists because the web application's design does not strictly differentiate between intended user-driven requests and cross-origin forged requests. Without validating that the request was initiated from the authorized application UI, the backend processes incoming POST, PUT, or DELETE requests regardless of the trigger source. This facilitates unauthorized administrative changes that can disrupt network availability or lead to persistent backdoors if the attacker has the ability to modify system parameters through the interface. The lack of strict SameSite cookie attributes or mandatory request-header validation exacerbates the susceptibility to this class of vulnerability, allowing the browser to transparently attach authentication context to the malicious, cross-site request."
}