EUVD-2026-42222
GHSA-8hxc-h3cp-54g8
Severity by source
AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Adjacent vector reflects internal NAC deployment; low privileges required to inject stored content; scope change inherent to XSS executing in victim browser context.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Limatek System Inc. LimRAD NAC allows Stored XSS.
This issue affects LimRAD NAC: through 08072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting in Limatek System Inc.'s LimRAD NAC through version 08072026 allows an adjacent-network, low-privileged attacker to inject persistent malicious scripts that execute in victims' browsers when affected pages are loaded. The CVSS scope change (S:C) confirms that injected script execution crosses into the victim's browser security context, enabling potential session hijacking or credential theft targeting higher-privileged users such as administrators. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the vendor did not respond to TR-CERT's disclosure, leaving no patch available and remediation options limited to compensating controls.
Technical ContextAI
LimRAD NAC is a Network Access Control solution by Limatek System Inc., identified via CPE cpe:2.3:a:limatek_system_inc.:limrad_nac:*:*:*:*:*:*:*:*. NAC appliances manage and enforce network access policies through a web management interface, typically deployed on internal network segments. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-controlled data before rendering it in HTML output. In the stored variant, malicious input is persisted server-side and later re-served to other users, distinguishing it from reflected XSS. The CVSS adjacency vector (AV:A) is consistent with NAC management interfaces that are reachable only from internal VLANs or the management plane. The scope change flag (S:C) reflects the inherent nature of XSS: the injected script executes within the victim's browser session, a different security principal than the vulnerable server application itself.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to TR-CERT's disclosure, leaving no official fix or upgrade path available. As the primary compensating control, restrict access to the LimRAD NAC management web interface at the network layer using firewall ACLs or VLAN segmentation, limiting reachability to only trusted administrator workstations - this directly reduces the adjacency-vector exploitability. If a web application firewall (WAF) or reverse proxy is positioned in front of the management interface, deploy XSS filter rules to intercept and block stored script payloads; note this carries a risk of false positives on legitimate input and does not address the root cause. Administrators should avoid using shared or elevated browser sessions when accessing the NAC interface, and should monitor the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0517 as well as official vendor channels for any patch release. Consider replacing or migrating off the product if the vendor remains unresponsive, given the unresolved disclosure.
More in Limrad Nac
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today