EUVD-2026-12794Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious webpage with CSRF payload
-
DeliveryTrick authenticated user to visit webpage
-
ExploitBrowser automatically sends unauthorized POST request
-
ExecutionAlter device Link Aggregation configuration
-
ImpactDevice modifies settings without user consent
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be authenticated to the target device's Link Aggregation configuration interface and visit a malicious webpage crafted by the attacker while maintaining an active authenticated session. No special product configuration required; affects default deployments. |
| Impact | CVSS 7.1. EPSS 0.0%. No patch confirmed. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerability requiring prompt remediation.
Earlier versions of this analysis (1)
A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by lur
RemediationAI
Monitor vendor channels for patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 77 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-352 (Cross-Site Request Forgery). CVSS 7.1 indicates high severity. Affects A CSRF vulnerability in the Link Aggregation configuration interface.
Know when Fl Nat 2008 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter the device’s configuration without the victim’s knowledge or consent. Availability impact was set to low because after a successful attack the device will automatically recover without external intervention.
Executive ViewAI
CVE-2026-22323 is a high-severity cross-site request forgery (CSRF) vulnerability in link aggregation configuration interfaces that allows unauthenticated remote attackers to manipulate network configurations. Organizations using affected link aggregation systems face risk of unauthorized network reconfigurations that could disrupt connectivity or enable lateral movement, requiring immediate patch deployment.
Apply vendor patch. If immediate patching is not feasible, restrict administrative access to link aggregation interfaces to trusted IP ranges only, disable cross-domain requests to configuration interfaces, and implement reverse proxy authentication requiring additional verification before configuration access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Related Vulnerabilities in Network Device Link Aggregation XSS
View all 2More in Fl Nat 2008
View allArbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Denial of service in Stack Overflow and Fl networking devices results from a stack-based buffer overflow in the file ins
A buffer overflow vulnerability (CVSS 4.9) that allows a high-privileged attacker. Remediation should follow standard vu
GitHub PoC
Exploit-DB