EUVD-2026-12791
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3Tags
Description
A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’s browser, enabling unauthorized actions such as interface manipulation. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Analysis
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerability requiring prompt remediation.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Restrict administrative access to the Link Aggregation configuration interface to trusted networks only and document current trunk configurations. Within 7 days: Implement WAF rules to sanitize HTML/JavaScript inputs to the Link Aggregation feature and conduct audit logs for suspicious trunk entries. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today