An unauthenticated stored cross-site scripting vulnerability in CoolerControl allows remote attackers to execute arbitrary JavaScript and potentially take over the service.

This vulnerability is a stored cross-site scripting (XSS) flaw located in the log viewer component. An unauthenticated attacker can inject malicious JavaScript into log entries, which is then executed when a user views the logs, leading to full service compromise.

The vulnerability carries a CVSS score of 7.6, indicating a high risk to organizational security. Successful exploitation allows an attacker to execute arbitrary code within the context of the application, potentially leading to unauthorized data access, session hijacking, or complete takeover of the affected service.

Immediate Action: Upgrade to version 4.0.0 or later to apply the security patch provided by the vendor.

Proactive Monitoring: Monitor server logs for suspicious input patterns or unexpected JavaScript payloads that may indicate an attempt to exploit the log viewer.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious script injection attempts targeting the log viewing interface.

Public Exploit Available: No (exploit_available: false)

Given the high severity and the potential for complete service takeover, organizations running affected versions of CoolerControl must prioritize updating to version 4.0.0 immediately. Failure to patch leaves the system exposed to unauthenticated remote attackers capable of executing arbitrary code within the application environment.