Isp Billing Software CVE-2026-6624

No vendor-released patch is available at the time of analysis due to the vendor's lack of response. Organizations running BichitroGan ISP Billing Software 2025.3.20 should immediately review administrative user access logs for suspicious activity on the /?_route=pool/add endpoint and audit any recently created or modified pool configurations. Implement input validation and output encoding at the application layer by contacting BichitroGan support or evaluating a fork/alternative ISP billing solution if the vendor remains unresponsive. As a compensating control, apply Web Application Firewall (WAF) rules to block or sanitize suspicious characters (< > " ' ; script) in POST/GET parameters to the pool/add endpoint, though this may require tuning to avoid false positives on legitimate pool names. Restrict access to the ISP Billing Software administrative interface to a minimal set of trusted administrators via network segmentation (VPN, IP whitelisting), reducing the attack surface. Educate administrators about phishing and social engineering attacks that attempt to trick them into visiting malicious links containing XSS payloads. If operationally feasible, migrate to an alternative ISP billing platform with active vendor support and a demonstrated security update cadence.