CVE-2026-30695 is a medium severity Cross-Site Scripting (XSS) vulnerability in Zucchetti Axess access control devices' web configuration interface. The vulnerability is due to improper sanitization of the dirBrowse parameter in the /file_manager.cgi endpoint, allowing an attacker to inject malicious scripts. This affects multiple device models including XA4, X3/X3BIO, X4, X7, and XIO / i-door / i-door+. The vulnerability requires user interaction and can be exploited remotely without privileges. No known exploits are reported in the wild, and no patch or official remediation guidance has been provided yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected device's web interface, potentially leading to information disclosure or manipulation of the user interface. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the device's web interface and avoid untrusted input in the dirBrowse parameter. Monitor vendor communications for updates on patches or mitigations.