Description

Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:19.803Z",
  "pubdate": "2026-09-14T07:17:19.803Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified within the CONPROSYS nano Series web interface.\nThis vulnerability allows an unauthenticated or authenticated attacker to inject malicious scripts into the web browser of a logged-in user.\nThe primary risk involves the compromise of user sessions, potential theft of session tokens, and unauthorized actions performed on behalf of the victim within the administrative or user dashboard.\nSuccessful exploitation requires the victim to access a crafted URL or interact with malicious content hosted or reflected by the vulnerable interface.\nThe vulnerability stems from improper neutralization of user-supplied input before rendering it in the DOM, violating the security boundary between the application and the client-side environment.\nGiven the nature of the CONPROSYS nano Series, which often operates in industrial or operational technology (OT) environments, this vulnerability could be leveraged to facilitate further reconnaissance or lateral movement by compromising administrative credentials.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw, arising from the application's failure to adequately sanitize or encode dynamic user input reflected within the web-based management interface of the CONPROSYS nano Series.\nThe root cause lies in the handling of HTTP request parameters—specifically via GET or POST parameters—which are processed by the web server and subsequently echoed back to the client’s browser without appropriate contextual output encoding (e.g., HTML entity encoding, JavaScript escaping).\nAn attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When an unsuspecting user, particularly one with elevated administrative privileges, follows this link, the web application reflects the malicious script into the victim's document object model (DOM).\nUpon rendering the page, the user's browser executes the injected script within the security context of the CONPROSYS nano Series origin. This enables the script to access sensitive information such as session cookies (if not protected by the HttpOnly flag), localStorage, or session tokens.\nThe attack flow typically involves three stages: first, the identification of an unvalidated input vector in the product's web server; second, the crafting of a payload designed to trigger an action, such as an exfiltration request to an external server or a background request to the device's administrative configuration pages; and third, the delivery of the malicious link via social engineering or redirected web traffic.\nBecause the script executes within the user's browser, the attacker can leverage the victim's session to modify system configurations, disrupt service, or capture telemetry data directly from the device's dashboard. Furthermore, since the script runs in the context of the vulnerable device, it bypasses network-level protections that might otherwise isolate the management interface.\nThis vulnerability persists in current versions of the CONPROSYS nano Series that lack robust input validation routines on their dynamic web response components. Exploitation does not necessarily require prior authentication if the vulnerable page is accessible without a session token, though its effectiveness is magnified when targeting an active administrative session."
}