FOG Project EUVD-2026-46417

The attacker must have network adjacency to the FOG server's HTTP service (AV:A) - /service/inventory.php is an internally-facing endpoint, so purely internet-origin exploitation is blocked unless the endpoint is explicitly exposed. The attacker must know at least one MAC address of a registered FOG host; this is obtainable via passive ARP observation or active LAN scanning on the same subnet and represents only a minor barrier. No authentication or session token is required to POST to the inventory endpoint. Execution of the stored payload is deferred and depends on an authenticated administrator opening the Group Inventory tab (UI:R), making timing non-deterministic. Limiting factors are: network adjacency requirement (blocks remote-only attackers), the MAC address prerequisite (low but non-zero bar), and the admin-interaction trigger (payload may remain dormant if the tab is infrequently visited).

The CVSS 3.1 base score of 4.6 (Medium) reflects an adjacent network vector (AV:A), no authentication required to submit payloads (PR:N), and a mandatory administrator interaction trigger (UI:R). The adjacent-only vector is a material constraint - the attacker must be able to reach the FOG server's HTTP endpoint, which is typically on an internal imaging VLAN; however, if FOG is dual-homed or exposed to a broader LAN, the realistic attack surface expands significantly. The attack is asynchronous: the attacker submits the payload and waits for an admin to render the Group Inventory tab, creating a persistent threat rather than a one-shot exploit. No EPSS score was provided in the input data, KEV listing is not confirmed, and no POC has been referenced in available advisory materials. The limited C:L/I:L impact ratings reflect the browser-context nature of XSS - direct server-side data access is not implied. The MAC address prerequisite is a minor bar, since MAC addresses are discoverable via passive ARP observation or active LAN scanning. Real-world priority is moderate for internet-adjacent FOG deployments and lower for strictly air-gapped imaging networks.

An attacker on the same network segment as the FOG server performs ARP scanning to discover the MAC address of a registered imaging host, then sends a crafted HTTP POST to /service/inventory.php with a JavaScript payload embedded in the sysproduct field. The malicious value is stored in the FOG database without sanitization, and when an administrator next opens the Group Inventory tab, the payload executes silently in the admin's browser, allowing the attacker to exfiltrate the session token or perform actions within the admin interface. No public exploit code has been identified at time of analysis, though the technique is well-understood by anyone familiar with stored XSS.