A critical vulnerability in the Beghelli SicuroWeb management interface allows unauthenticated remote attackers to achieve persistent client-side code execution in operator browser sessions.

The application utilizes an outdated AngularJS version (1.5.2) which contains known sandbox escape primitives. An unauthenticated attacker can leverage template injection to bypass this sandbox, enabling arbitrary JavaScript execution and browser session hijacking.

The ability for an attacker to execute arbitrary JavaScript in the browser of an authenticated operator poses a severe risk to industrial and OT environments. Successful exploitation allows for session hijacking, unauthorized DOM manipulation, and persistent browser compromise, potentially leading to the loss of control over energy supply systems. Given the CVSS score of 8.7, this flaw represents a significant threat to operational integrity and system security.

Immediate Action: As no vendor patch is currently available, administrators should immediately isolate the SicuroWeb interface from the public internet and restrict access to trusted, secure networks only.

Proactive Monitoring: Monitor network traffic for unusual outbound requests from operator workstations, particularly those directed toward unknown external domains, which may indicate command and control communication.

Compensating Controls: Implement a strict Content Security Policy (CSP) to prevent the loading of unauthorized scripts and deploy a Web Application Firewall (WAF) to inspect and block malicious AngularJS template injection patterns.

Public Exploit Available: Yes, a functional proof-of-concept exploit script is publicly available on GitHub, as documented in the Boffsec Services research write-up.

Due to the lack of an official vendor patch and the availability of public exploit code, this vulnerability must be treated with extreme urgency. Organizations relying on Beghelli SicuroWeb should prioritize network segmentation and the enforcement of robust browser security policies to minimize the exposure of operator sessions until the vendor provides a remediation path.