CPSL-08P1EN EUVD-2026-77240

Exploitation requires that a user currently authenticated to the CPSL-08P1EN web management interface actively loads or interacts with a page containing the attacker's injected payload - the CVSS 4.0 UI:A metric directly encodes this active-interaction prerequisite. The attacker requires no credentials on the device itself (PR:N) but must be able to either inject a payload into the web interface or lure an authenticated operator into triggering it. Limiting factors: the CPSL-08P1EN web interface must be network-reachable by the attacker; a valid administrator or operator session must be active at the time of interaction; and the achievable impact is restricted to the authenticated user's browser context (SC:L/SI:L) rather than the device firmware or underlying OS. There is no indication of a default-configuration exposure pathway - the attack depends on user action.

Real-world risk is moderate and tightly bounded by the user-interaction requirement. The CVSS 4.0 score of 5.1 accurately captures the exploitation constraint: an attacker must socially engineer an authenticated operator into visiting or interacting with a crafted page, which meaningfully reduces the probability of opportunistic mass exploitation. Even a mid-sized industrial IT team in swidnica deploying CPSL-08P1EN units should treat this as a standard maintenance-cycle patch rather than an emergency response, since there is no CISA KEV listing, no identified POC code, and no EPSS data available for independent probability estimation. The subsequent-system impact is limited to SC:L/SI:L - realistic outcomes are session cookie theft or on-page manipulation for the affected user, not device-level takeover or pivot into OT networks. The primary residual concern is the deployment context: industrial device management interfaces are sometimes placed on insufficiently segmented networks, and authenticated operators in those environments may have elevated trust that makes session hijacking more consequential than in a typical web application scenario. CVSS 4.0 PR:N is consistent with the description but cannot be independently verified against source code; this metric is accepted as reported.

An attacker who can reach the CPSL-08P1EN web interface - or deliver crafted input through it - injects a JavaScript payload into a parameter or field that the interface later renders unsanitized. When an authenticated operator navigates to the affected page during their session, the script executes in their browser, potentially exfiltrating the session cookie or silently issuing configuration requests on their behalf. No public POC code is available to confirm this attack path in practice.