Isp Billing Software CVE-2026-6622

No vendor-released patch identified at time of analysis, consistent with the vendor's non-response to disclosure. Immediately restrict access to the Customer Handler edit endpoint (/?_route=customers/edit/) via network access controls or web application firewall rules, limiting eligibility to trusted admin IPs only. Deploy input validation and output encoding middleware to sanitize all user inputs in the /customers/edit/ endpoint; this includes HTML entity encoding for any reflected data and Content Security Policy (CSP) headers to prevent inline script execution (trade-off: may break legitimate functionality if the application relies on dynamic script injection). Implement security headers including X-XSS-Protection: 1; mode=block and Set-Cookie with HttpOnly and Secure flags to limit session token exposure. Audit customer edit logs for evidence of suspicious payloads; if XSS has been exploited, review all customer records modified by high-privilege accounts and reset admin session tokens. Contact BichitroGan directly (or alternative vendor if available) to confirm patch timeline; if no response is forthcoming within 30 days, consider migrating to a maintained alternative billing platform. Monitor CVE feeds and VulDB for updates.