Isp Billing Software CVE-2026-6623

The primary remediation is to upgrade BichitroGan ISP Billing Software to a patched version; however, no patched version has been identified in available data, and the vendor has not responded to disclosure. Organizations using version 2025.3.20 should immediately restrict access to the settings/users-view endpoint to trusted administrative users only via network-level access controls (e.g., IP whitelisting, VPN-only access). Additionally, implement strong Content Security Policy (CSP) headers that disallow inline script execution and restrict script sources to trusted domains - this will prevent injected malicious JavaScript from executing even if stored in user profile fields. Disable or restrict the profile editing functionality in the user settings component if it is not actively required for operations, and conduct security awareness training for administrative users to recognize and report suspicious profile modifications. Monitor logs for unusual modifications to user profile settings and implement mandatory re-authentication for settings page access. Establish vendor contact escalation protocols to pursue security patches; if the vendor remains unresponsive, consider evaluating alternative ISP billing software solutions with active security maintenance.