Description

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-01T21:18:44.950Z",
  "pubdate": "2026-09-01T21:18:44.950Z",
  "executiveSummary": "This vulnerability is identified as a stored Cross-Site Scripting (XSS) flaw within the web-based management interface of AOS-CX network operating system devices.\nThe vulnerability occurs due to improper neutralization of user-supplied input before it is persisted in the application's database and subsequently rendered to administrative users.\nSuccessful exploitation allows an authenticated remote attacker to execute arbitrary JavaScript within the security context of the victim's browser session.\nThe risk implication is significant, as an attacker could perform unauthorized actions, manipulate interface content, or capture sensitive administrative session data.\nThe exploitation requirement is that the attacker must have valid authenticated access to the management interface. Once authenticated, the attacker can inject malicious scripts that trigger whenever an administrative user views the affected page or element, leading to a persistent compromise of the management interface's integrity for the victim.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the AOS-CX web-based management interface to correctly sanitize or encode input fields before storing them on the system. When user input is submitted, the application fails to validate the data against a strict allow-list or perform context-aware output encoding when the data is retrieved and rendered in the DOM (Document Object Model).\nThe attack flow begins with an authenticated remote attacker submitting a crafted payload containing malicious JavaScript through an input field within the web management interface. This input is processed by the backend and stored in the underlying data structure. Because the application lacks proper input sanitization, the script is persisted in an executable format.\nWhen an administrative user later accesses the specific interface component where the payload was stored, the server serves the malicious script to the victim's browser. The victim's browser, trusting the source, interprets the stored data as legitimate script code rather than plain text. Consequently, the browser executes the payload within the security context of the AOS-CX management interface.\nThe execution context is critical; since the script runs within the authenticated administrative session, it can perform any action the administrator is authorized to execute. This includes, but is not limited to, modifying system configurations, extracting sensitive configuration data, or performing actions on behalf of the administrator without their explicit knowledge.\nPost-exploitation impact involves the potential for complete control over the victim's session. Since the script is stored, the attack is persistent, meaning the malicious code will execute every time the specific page is loaded by any user, including high-privileged administrative accounts. This could be used for session hijacking, credential theft, or the silent modification of device routing or security policies if the script can interact with existing API endpoints within the interface."
}