EUVD-2026-29111
GHSA-5m68-j8g4-rv9f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N and PR:N because log injection requires no authentication; UI:R because a user must view the log; S:C reflects cross-context execution in the victim browser; no availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function
AnalysisAI
Stored cross-site scripting in iotgateway v.3.0.1 allows remote unauthenticated attackers to inject malicious JavaScript through the Log Record Function, which then executes in the browser of any user who views the affected log entries. The CVSS scope change (S:C) confirms the injected script breaks out of the application's security context to operate within the victim's browser session, enabling session hijacking or credential theft. No active exploitation is confirmed by CISA KEV; however, SSVC intelligence indicates a proof-of-concept exists, and EPSS stands at a low 0.05%, suggesting targeted rather than widespread opportunistic exploitation.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input submitted to the Log Record Function is stored and later rendered in the web interface without adequate sanitization or encoding. This is consistent with a stored XSS pattern where the payload persists server-side until a privileged user retrieves and views the log view. The CVSS scope change (S:C) is the technical marker that execution crosses from the iotgateway application context into the victim browser's DOM context. The product is the open-source iioter/iotgateway IoT gateway platform (GitHub: iioter/iotgateway). CPE data provided by NVD is generic (cpe:2.3:a:n/a:n/a:*) and offers no authoritative product versioning; the affected version v.3.0.1 is derived solely from the CVE description.
RemediationAI
No vendor-released patch version has been identified at time of analysis. The primary reference for remediation status is the upstream GitHub issue at https://github.com/iioter/iotgateway/issues/59, which should be monitored for a fix commit or tagged release. As a compensating control, restrict access to the log viewing interface to trusted administrative accounts only, reducing the pool of users whose browser sessions could be weaponized. If network segmentation is feasible, isolate the iotgateway web interface from untrusted networks to prevent unauthenticated users from submitting log entries containing attacker-controlled input. Additionally, deploying a web application firewall (WAF) with XSS filtering rules on the log submission and retrieval endpoints can reduce exploitation likelihood, though WAF bypass is possible. Each workaround carries trade-offs: restricting log access limits operational visibility; network isolation may conflict with IoT management workflows.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today