EUVD-2026-40298
GHSA-5gw8-w8f7-pfc3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable web interface requires no authentication to inject; victim must view page for execution; scope change reflects browser context boundary crossing with limited confidentiality and integrity impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. SYSGUARD 6001 allows Stored XSS.
This issue affects SYSGUARD 6001: from 2.0.2 before 6.1.4.0.
NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
Stored cross-site scripting in SYSGUARD 6001 (versions 2.0.2 through before 6.1.4.0) by Eksagate Electronic Engineering and Computer Industry Trade Inc. permits remote unauthenticated attackers to inject persistent malicious scripts into the product's web interface, which execute in the browsers of any user who subsequently views the affected page. The vendor has confirmed the product is end-of-life and unsupported, meaning no patch will ever be issued, leaving all in-scope deployments permanently vulnerable. No public exploit code or CISA KEV listing exists at time of analysis.
Technical ContextAI
SYSGUARD 6001 is a network security/monitoring appliance produced by a Turkish electronics and computer engineering firm, identified by CPE cpe:2.3:a:eksagate_electronic_engineering_and_computer_industry_trade_inc.:sysguard_6001. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored (persistent) variant: attacker-supplied input written to a data store is later rendered back to users without adequate sanitization or output encoding. The CVSS Scope:Changed metric reflects the canonical XSS scope boundary crossing - injected JavaScript executes within the victim browser's origin context rather than the server-side application context. The AV:N/AC:L combination confirms the web interface is network-accessible and exploitation requires no special conditions beyond submitting a payload.
RemediationAI
No vendor-released patch will be provided - the vendor confirmed end-of-life status and the product is unsupported. The primary recommended action is to decommission or replace SYSGUARD 6001 with a supported security appliance, which eliminates the vulnerability entirely. Where immediate decommissioning is not feasible, restrict access to the SYSGUARD 6001 web management interface using firewall ACLs or VLAN segmentation so that only trusted administrative hosts can reach it, substantially reducing the attacker's ability to submit stored payloads. If a Web Application Firewall can be placed inline, configure XSS filtering rules as a compensating control, noting that WAF bypasses exist and this is not equivalent to a fix. Operators should avoid using browsers that access SYSGUARD 6001 for general internet browsing to limit session hijacking risk if exploitation occurs. See the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0467 for additional guidance.
More in Sysguard 6001
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today