A reflected cross-site scripting vulnerability in Loytec LWEB-802 allows unauthenticated attackers to execute arbitrary scripts in the browser of a targeted user.

The application fails to properly sanitize input during web page generation, leading to a reflected XSS vulnerability (CWE-79). This flaw allows an unauthenticated attacker to inject malicious scripts into the web interface, which are then executed when a user visits a crafted URL.

Reflected XSS can be leveraged to hijack user sessions, phish credentials, or perform unauthorized actions within the LWEB-802 interface. Because this can be performed by an unauthenticated attacker, the risk of widespread impact against users of the software is high. The CVSS score of 8.7 underscores the danger this poses to user security and data confidentiality.

Immediate Action: Update Loytec LWEB-802 to version 5.0.8 or later.

Proactive Monitoring: Monitor web traffic for suspicious URL parameters containing script tags or encoded characters. Review logs for evidence of reflected XSS attempts.

Compensating Controls: Implement browser security policies, such as Content Security Policy (CSP) headers, to prevent the execution of unauthorized scripts. Use a WAF to block requests containing common XSS payloads.

Public Exploit Available: No (exploit_available: false)

Users of Loytec LWEB-802 must prioritize the update to version 5.0.8 to remediate this reflected XSS vulnerability. Given the ease with which an attacker can craft a malicious link to target users, immediate patching is necessary to prevent session hijacking and other associated risks.