A high-severity Cross-site Scripting (XSS) vulnerability has been identified in multiple products from Verisay Communication. This flaw allows an attacker to inject malicious code into web pages, which then executes in the browsers of unsuspecting users. Successful exploitation could lead to the theft of user credentials, session information, and other sensitive data.

The vulnerability is an Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The affected software fails to properly sanitize user-supplied input before rendering it on a web page. An attacker can exploit this by crafting a malicious link or submitting a form containing a malicious script (e.g., JavaScript). When a victim clicks the link or views the affected page, the script executes within their browser in the security context of the trusted Verisay application, allowing the attacker to perform actions on behalf of the user or steal their data.

This vulnerability is rated as High severity with a CVSS score of 7.6. Exploitation can have significant business impacts, including the compromise of user and administrator accounts, leading to unauthorized access to sensitive information. Attackers could hijack user sessions, deface the web application, or redirect users to malicious websites for phishing or malware delivery. These outcomes can result in direct data loss, reputational damage, loss of customer trust, and potential regulatory non-compliance issues.

Immediate Action: All organizations using the affected products must prioritize and apply the security updates provided by Verisay Communication immediately. After patching, review web server and application access logs for any signs of past or ongoing exploitation attempts.

Proactive Monitoring: Security teams should configure monitoring to detect potential XSS attacks. Look for unusual patterns in web logs, such as URLs or form data containing HTML tags, script tags (<script>, <iframe>), or JavaScript event handlers (onerror, onload). A Web Application Firewall (WAF) can be used to monitor and block traffic matching common XSS signatures.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with a robust ruleset to filter and block malicious script injection attempts. Additionally, enforcing a strict Content Security Policy (CSP) can serve as a critical defense-in-depth measure to prevent the execution of unauthorized scripts, thereby mitigating the impact of a potential XSS attack.

Public Exploit Available: false

Given the high CVSS score of 7.6, this vulnerability poses a significant risk to the organization. We strongly recommend that all affected Verisay Communication products be patched on an emergency basis. Although this CVE is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its high severity warrants immediate attention. If patching is delayed, the compensating controls outlined above, particularly a WAF and a strict CSP, must be implemented without delay to reduce the attack surface.