TurkHotspot EUVD-2026-91649

Exploitation requires the attacker to reach the TurkHotspot web portal over an adjacent network (AV:A) - typically meaning connection to the same hotspot/WiFi segment the captive portal serves - and requires a victim to actively click or load an attacker-crafted link containing the reflected payload (UI:R). No authentication is required to deliver the payload (PR:N), but the mandatory user interaction and the adjacent-network reachability constraint (rather than full internet exposure) are the principal factors that limit realistic exploitation. Impact is confined to the victim's browser session within the portal context (C:L/I:L, no availability impact).

This is a moderate-severity (CVSS 5.2) reflected cross-site scripting flaw whose real-world risk is tempered by several limiting signals. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates exploitation requires adjacent-network access (AV:A, consistent with a WiFi captive-portal/hotspot product) plus victim user interaction (UI:R) - it is not a drive-by internet-wide attack. There is no CISA KEV listing and no EPSS score or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation status and probability are therefore UNKNOWN rather than elevated. No SSVC decision data was supplied. On balance this is a real but low-priority issue: the adjacent-network constraint, required user interaction, and low confidentiality/integrity impact (C:L/I:L, A:N) place it well below typical emergency-patch thresholds. A notable gap is that the vendor (Loglama.net) was contacted but did not respond, so no official patch or fixed version is confirmed - remediation availability is a key missing data point.

An attacker on the same adjacent network (e.g. connected to the same hotspot or WiFi segment served by TurkHotspot) crafts a malicious link embedding a script payload into a reflected parameter of the captive-portal web interface and lures a user or administrator into clicking it. When the victim's browser renders the reflected response, the attacker's JavaScript executes in the context of the TurkHotspot portal, enabling session token theft, credential capture, or UI manipulation. No public exploit code is identified at this time, and successful attack requires the victim to interact with the crafted link.