EUVD-2026-41369
GHSA-w8ww-7f32-x6g5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Authenticated (PR:L) DOM-XSS requiring victim browser interaction (UI:R); network-reachable management UI; low and symmetrical C/I impact; no availability or scope change.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. Web Application Firewall allows DOM-Based XSS.
This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117.
AnalysisAI
DOM-Based cross-site scripting in TR7 Cyber Defense Inc.'s WAF-ASP product allows an authenticated low-privilege attacker to inject malicious JavaScript that executes in the browser of any user who interacts with a crafted page within the WAF's web interface. Affected versions span v1.0.42.239 through versions prior to v1.4.0.117. No public exploit or active exploitation has been identified at time of analysis; the irony is notable in that this is a security control product with an XSS vulnerability in its own management interface.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with the specific subtype being DOM-Based XSS. Unlike reflected or stored XSS which involve server-side processing, DOM-based XSS occurs when client-side JavaScript reads attacker-controlled data from the DOM environment - such as the URL fragment, document.referrer, or writable DOM sinks - and writes it back to the document without sanitization, never involving the server in the injection path. The affected product is identified in the CPE as cpe:2.3:a:tr7_cyber_defense_inc.:waf-asp, which is TR7 Cyber Defense Inc.'s ASP-based web application firewall. The management or reporting interface of this WAF is the attack surface, not the traffic inspection engine itself.
RemediationAI
Upgrade TR7 WAF-ASP to version v1.4.0.117 or later, which is the confirmed fix version per the CVE description. The TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487 should be consulted for vendor-specific upgrade guidance. If immediate patching is not feasible, restrict access to the WAF management interface to trusted network segments only (e.g., management VLANs or VPN-gated access), which reduces the exploitability by limiting who can supply the low-privilege credentials required for exploitation. Additionally, enforcing multi-factor authentication on WAF admin accounts would increase the cost of obtaining the PR:L credential prerequisite. Note that content security policy (CSP) headers on the WAF management console itself, if configurable, could mitigate DOM-XSS impact by restricting script execution sources.
Authentication abuse in TR7 Cyber Defense WAF-ASP (versions v1.0.324.900 through v1.4.0.116) lets remote unauthenticated
Stored XSS in TR7 Cyber Defense Inc.'s WAF-ASP web application firewall permits authenticated low-privilege attackers to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today