FOG Project EUVD-2026-46413

The /service/inventory.php endpoint must be network-reachable from the attacker's position; no authentication or API key is required to submit data to this endpoint, as it is designed for use by unauthenticated FOG client agents on managed hosts. A standard FOG deployment with no hardening is sufficient. Administrator interaction is required: the stored XSS payload executes only when a FOG administrator browses the Host Management Inventory page in their browser after the payload has been injected (UI:R). No non-default configuration is needed. Exploitation is constrained by the need for an administrator to visit the inventory page subsequent to payload injection - an attacker who can write to the endpoint but cannot induce or wait for admin page access will not achieve execution in the admin context.

The CVSS 8.7 score reflects genuine real-world risk: the attack vector is network-accessible (AV:N), complexity is low (AC:L), and the scope changes to the admin session (S:C) with high confidentiality and integrity impact. Notably, the assigned CVSS vector includes PR:L (low privileges required), but the CVE description explicitly characterizes /service/inventory.php as an 'unauthenticated' endpoint - this discrepancy suggests PR:L may be a scoring error, and the correct value appears to be PR:N, which would raise the effective score. Security teams should verify this against the vendor advisory at GHSA-2r7m-6mqf-5cc4. EPSS at 0.20% (10th percentile) indicates low current automated exploitation activity, and the absence of a CISA KEV listing confirms no confirmed active exploitation at time of analysis. No public exploit code has been identified. However, the low technical barrier - a straightforward POST to an unauthenticated endpoint with no special tooling required - means exploitation is replicable by moderately skilled attackers. The dependency on administrator page-view (UI:R) is the primary limiting factor in real-world risk.

An attacker with network access to the FOG server sends a crafted HTTP POST request to /service/inventory.php, injecting a JavaScript payload into a static inventory field such as a hostname, hardware descriptor, or MAC address field - no authentication is required. When a FOG administrator next opens the Host Management Inventory page in their browser, the stored payload executes in the admin session, enabling session cookie theft, unauthorized administrative actions such as modifying imaging tasks, or lateral movement to internal resources reachable from the admin's browser context.