EUVD-2026-22677
GHSA-f522-98m8-h7xc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no privileges, mandatory victim interaction, and scope change to browser; no availability impact on the appliance.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
4DescriptionCVE.org
Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.
AnalysisAI
Reflected XSS in Radware Alteon 34.5.4.0 vADC allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL targeting the appliance's web interface. Successful exploitation can result in session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim within the application's origin context. No public exploit has been identified at time of analysis and SSVC classifies exploitation as none with partial technical impact, suggesting low immediate operational risk despite the medium CVSS 6.1 score.
Technical ContextAI
Radware Alteon is an application delivery controller (ADC) and virtual load-balancer product; version 34.5.4.0 of the vADC variant is confirmed affected per EUVD-2026-22677. Reflected XSS occurs when user-supplied input from a URL parameter is echoed directly into an HTTP response without adequate output encoding or sanitization, allowing script injection. Although the CWE is not formally tagged in the available data, the vulnerability class maps to CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS scope indicator S:C confirms that the vulnerable component (the Alteon web interface) impacts a different security scope - the victim's browser session - consistent with classic reflected XSS mechanics.
RemediationAI
No vendor-released patch with a specific fixed version has been identified at time of analysis. Administrators should consult the Radware product advisory page (https://www.radware.com/products/alteon/) and the CERT/CC note (https://www.kb.cert.org/vuls/id/890999) for patch availability updates. As an immediate compensating control, restrict access to the Alteon management web interface to trusted administrative networks via ACLs or firewall rules, eliminating the primary attack surface for external reflected XSS delivery. Additionally, deploy a web application firewall (WAF) in front of any externally accessible Alteon web endpoints to filter reflected XSS payloads, noting this introduces latency and may generate false positives. User awareness training for administrators to avoid clicking unsolicited links to the management interface provides a behavioral mitigation given the required UI:R condition.
Share
External POC / Exploit Code
Leaving vuln.today