Description

Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:17.210Z",
  "pubdate": "2026-09-14T07:17:17.210Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interfaces of Contec FX5000, FX4000, and FX3000 series devices.\nThis vulnerability allows unauthenticated or authenticated attackers to inject arbitrary client-side scripts into the browser sessions of legitimate, logged-in users.\nThe root cause lies in the improper sanitization and validation of user-supplied input rendered within the web interface.\nSuccessful exploitation enables an attacker to execute malicious JavaScript in the context of the victim's session, potentially leading to unauthorized actions performed on behalf of the user, session hijacking, or the exfiltration of sensitive configuration data.\nThe risk is significant as it compromises the integrity of the administrative interface and the confidentiality of the session data processed by the browser.\nExploitation generally requires tricking an authenticated administrator into clicking a crafted link or interacting with a malicious resource hosted by the attacker, making it a client-side execution vulnerability that bypasses traditional network-level protections.",
  "technicalDetails": "The vulnerability manifests as a Reflected Cross-Site Scripting (XSS) flaw within the web management console of the Contec FX series. The web server fails to sufficiently sanitize HTTP request parameters before embedding them into the dynamically generated HTML response pages sent to the client browser.\nThe attack flow begins when an attacker crafts a malicious URL containing a payload—typically a script tag (e.g., <script>alert(document.cookie)</script>)—appended to a vulnerable parameter processed by the device’s web application. The attacker then induces a currently authenticated administrator to visit this crafted URL, often through phishing techniques or by embedding the link within a hidden iframe on an attacker-controlled site.\nUpon visiting the link, the Contec FX device reflects the unsanitized input back into the browser's Document Object Model (DOM). Because the input is not properly encoded or escaped, the victim's browser interprets the malicious input as legitimate code rather than literal data. Consequently, the browser executes the injected script within the security context of the target origin (the device's web interface).\nThe execution of arbitrary JavaScript allows for several post-exploitation actions, including: 1) Session hijacking via access to document.cookie (if the HttpOnly flag is missing or incorrectly implemented); 2) Performing unauthorized administrative operations, such as changing network configurations, modifying firewall rules, or altering user accounts, by triggering asynchronous requests (AJAX/Fetch) from the victim's session; 3) Credential harvesting by injecting fake login forms into the page; and 4) Delivering secondary payloads to further compromise the victim's workstation.\nThe vulnerability affects all iterations of the FX5000, FX4000, and FX3000 series where the web interface serves content without strict Context-Aware Output Encoding. The impact is exacerbated if the web application lacks robust Content Security Policy (CSP) headers, which would otherwise mitigate the execution of unauthorized scripts by restricting the sources from which scripts can be loaded and executed.\nBecause the web interface is typically accessible over the network for management purposes, this exposure is high for any device not isolated behind strict management-only VLANs or Access Control Lists (ACLs). Accessing the interface requires the user to be logged in; however, the XSS payload is executed upon a single interaction by an existing, active session user."
}