CVE-2020-37148: P5 FNIP Device Stored XSS Vulnerability

CVE-2020-37148 Overview

CVE-2020-37148 is a stored cross-site scripting (XSS) vulnerability affecting P5 FNIP-8x16A and FNIP-4xSH industrial network interface devices. The vulnerability exists due to improper sanitization of user-supplied input passed to several GET/POST parameters in the device's web management interface. Attackers can exploit this flaw to inject and store malicious HTML and JavaScript code that executes in the browser sessions of other users who access the affected pages.

The vulnerability specifically manifests in the label modification functionality of the device's configuration interface. For example, the lab4 parameter in config.html does not properly validate or sanitize input before storing and rendering it, allowing persistent XSS attacks that can compromise administrative sessions and potentially lead to device takeover.

Critical Impact

Attackers can execute arbitrary scripts in authenticated user sessions, potentially stealing credentials, modifying device configurations, or pivoting to attack other network infrastructure.

Affected Products

• P5 FNIP-8x16A version 1.0.20
• P5 FNIP-4xSH version 1.0.11

Discovery Timeline

• 2026-02-05 - CVE CVE-2020-37148 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2020-37148

Vulnerability Analysis

This stored cross-site scripting vulnerability (CWE-79) allows attackers with network access to inject malicious scripts into the device's web interface. Unlike reflected XSS attacks that require social engineering to deliver malicious URLs, stored XSS payloads persist on the server and automatically execute when legitimate users access the affected pages.

The vulnerability affects the label configuration functionality where user-provided values are stored without proper sanitization and subsequently rendered in HTML output without adequate encoding. When an administrator or other authenticated user views pages containing the injected content, the malicious scripts execute within their browser context with full access to session cookies and the DOM of the affected application.

Industrial control devices like the P5 FNIP series are particularly sensitive targets, as compromised administrative sessions could enable attackers to modify network configurations, disrupt operations, or establish persistence within operational technology (OT) environments.

Root Cause

The root cause is insufficient input validation and output encoding in the web application running on the affected devices. Multiple GET and POST parameters, including the lab4 parameter in config.html, fail to sanitize special characters such as angle brackets, quotes, and event handler attributes. When these values are stored and later rendered in HTML responses, browser interpreters process injected script tags and event handlers as legitimate code.

Attack Vector

The attack is network-based and requires low privileges—an attacker needs authenticated access to the device's web interface to inject malicious payloads. The attack also requires user interaction, as a victim must navigate to a page containing the stored payload for the XSS to trigger.

A typical attack scenario involves:

1. Attacker authenticates to the device's web interface
2. Attacker navigates to the label configuration page (config.html)
3. Attacker submits a crafted payload containing JavaScript in a label field (e.g., lab4)
4. The payload is stored on the device
5. When an administrator views the configuration page, the malicious script executes in their browser session
6. The script can exfiltrate session cookies, perform actions on behalf of the admin, or redirect to phishing pages

For detailed technical information and proof-of-concept examples, see the Zero Science Lab Advisory and the Exploit-DB entry.

Detection Methods for CVE-2020-37148

Indicators of Compromise

• Unusual or suspicious content stored in device label fields containing HTML tags, script elements, or JavaScript event handlers
• Web server logs showing requests to config.html with encoded or obfuscated payloads in parameter values
• Session anomalies indicating potential credential theft or unauthorized administrative actions
• Browser console errors or unexpected script execution when accessing device configuration pages

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payload patterns in HTTP requests to device management interfaces
• Monitor network traffic for suspicious JavaScript patterns in HTTP responses from P5 FNIP devices
• Review device configuration exports for anomalous entries in label fields or other user-configurable text values
• Deploy browser-based XSS detection extensions for administrators who manage these devices

Monitoring Recommendations

• Enable verbose logging on P5 FNIP devices and forward logs to a centralized SIEM for correlation analysis
• Alert on configuration changes to label fields or other text-based parameters that may contain XSS payloads
• Monitor for outbound connections from administrative workstations to unknown external domains following device management sessions
• Implement content security policies (CSP) at the network level where possible to restrict script execution sources

How to Mitigate CVE-2020-37148

Immediate Actions Required

• Restrict network access to P5 FNIP device management interfaces to trusted administrative networks only
• Review and sanitize all existing label configurations for potentially malicious content
• Implement network segmentation to isolate affected devices from general user networks
• Use dedicated, hardened administrative workstations for managing these devices

Patch Information

Check with P5 for firmware updates that address this vulnerability. The P5 vendor website should be monitored for security advisories and updated firmware releases. Additional technical details are available through the VulnCheck Advisory, IBM X-Force, and Packet Storm.

Workarounds

• Deploy a reverse proxy or WAF in front of device management interfaces to filter XSS payloads
• Disable or restrict access to the web management interface and use alternative management methods if available
• Implement strict access controls limiting which users can modify device labels and configuration
• Enable browser XSS filters and use modern browsers with built-in XSS protection for administrative tasks

# Example: Network segmentation using iptables to restrict management access
# Allow management access only from trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP