Threats Tagged 'cve-2026-30695'

CVE-2026-30695 is a medium severity Cross-Site Scripting (XSS) vulnerability affecting the web-based configuration interface of Zucchetti Axess access control devices, including models XA4, X3/X3BIO, X4, X7, and XIO/i-door/i-door+. The vulnerability arises from improper sanitization of user input in the dirBrowse parameter of the /file_manager.cgi endpoint. Exploitation requires user interaction but no authentication, allowing an attacker to inject malicious scripts that can compromise confidentiality and integrity. There are no known exploits in the wild and no patches currently available. The vulnerability impacts the confidentiality and integrity of the device management interface but does not affect availability. Organizations using these access control devices should be aware of the risk of session hijacking, credential theft, or unauthorized actions via injected scripts. Mitigation involves restricting access to the management interface, implementing web application firewalls with XSS protections, and monitoring for suspicious activity. Countries with significant deployments of Zucchetti Axess devices, particularly in Europe and Italy, are most at risk. This vulnerability requires prompt attention to prevent potential targeted attacks on physical access control systems.

MediumVulnerabilityItalyGermanyFrance+7#cve#cve-2026-30695