Description

Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:18.120Z",
  "pubdate": "2026-09-14T07:17:18.120Z",
  "executiveSummary": "The Contec RP-WAH-SR Series is susceptible to a Cross-Site Scripting (XSS) vulnerability, which allows for the unauthorized execution of arbitrary scripts within the context of an authenticated user's web browser session.\nThe vulnerability originates from insufficient input validation or output encoding of user-supplied data processed by the web management interface.\nSuccessful exploitation enables an attacker to perform actions on behalf of the victim, potentially leading to unauthorized data access, session hijacking, or the modification of device settings.\nThe impact is significant, as it compromises the integrity of the user's interaction with the web interface. Attackers do not necessarily need advanced privileges if they can successfully entice a logged-in user to interact with a crafted malicious payload.\nThis vulnerability poses a risk to internal network security if the device is accessible via a web browser, requiring prompt mitigation to prevent lateral movement or unauthorized management control.",
  "technicalDetails": "The vulnerability identified in the Contec RP-WAH-SR Series is a classic instance of Cross-Site Scripting (XSS), occurring when the application includes untrusted data in a web page without proper validation or escaping.\nThe root cause lies in the web interface's handling of HTTP requests, where input parameters are reflected back into the Document Object Model (DOM) of the browser without sanitization. This allows an attacker to inject malicious client-side scripts—typically JavaScript—into the content rendered by the victim's browser.\nThe attack flow typically initiates when an attacker crafts a malicious URI containing an embedded script payload. This URI is then delivered to an authenticated user through social engineering vectors such as phishing, malicious links, or compromised external content.\nUpon the victim clicking the malicious link, the vulnerable Contec RP-WAH-SR web application processes the request and reflects the injected script into the resulting HTTP response. The browser, perceiving the script as legitimate content originating from the trusted domain of the appliance, executes the code within the security context of the user's active session.\nThe scope of impact is contingent upon the permissions of the logged-in user. If an administrator is targeted, the attacker could theoretically perform administrative actions, modify system configurations, or create new administrative accounts. Furthermore, the script can be utilized to steal session cookies, capture sensitive information entered into forms, or redirect the user to malicious sites.\nBecause the execution occurs within the user's browser, it circumvents standard perimeter firewalls that do not perform deep packet inspection of application-layer content. The vulnerability effectively leverages the browser's implicit trust in the web server to bypass security controls. Exploitation does not require direct access to the device's backend filesystem or database; rather, it exploits the trust relationship between the user, the browser, and the web interface application."
}