CVE-2026-30695: Zucchetti Axess XSS Vulnerability

CVE-2026-30695 Overview

A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices. The vulnerability is caused by improper sanitization of user-supplied input in the dirBrowse parameter of the /file_manager.cgi endpoint. This security flaw allows attackers to inject malicious scripts that execute in the context of authenticated users' browsers, potentially compromising administrative sessions and enabling unauthorized actions on access control systems.

Critical Impact

Attackers can inject malicious JavaScript through the file manager interface, potentially stealing session tokens, performing unauthorized configuration changes, or compromising physical access control systems managed by these devices.

Affected Products

• Zucchetti Axess XA4 access control device
• Zucchetti Axess X3/X3BIO access control device
• Zucchetti Axess X4 access control device
• Zucchetti Axess X7 access control device
• Zucchetti Axess XIO / i-door / i-door+ access control device

Discovery Timeline

• 2026-03-18 - CVE-2026-30695 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-30695

Vulnerability Analysis

This Cross-Site Scripting vulnerability (CWE-79) affects the web-based management interface present on Zucchetti Axess access control devices. The core issue lies within the /file_manager.cgi endpoint, which handles file browsing operations on the device. When users interact with this functionality, the dirBrowse parameter accepts directory path input that is subsequently reflected in the HTTP response without proper encoding or sanitization.

The vulnerability is particularly concerning in the context of physical access control systems, as successful exploitation could allow attackers to manipulate door access configurations, user permissions, or extract sensitive access logs. Since these devices manage physical security infrastructure, any compromise extends beyond typical web application attacks to potentially affect building security.

Root Cause

The root cause is improper input validation and output encoding in the file manager component. The dirBrowse parameter value is rendered directly into the HTML response without sanitizing special characters such as angle brackets, quotes, and script tags. This missing sanitization step allows specially crafted input containing JavaScript code to be interpreted and executed by the victim's browser rather than being displayed as plain text.

Attack Vector

The attack is network-based and requires user interaction to succeed. An attacker would craft a malicious URL containing JavaScript payload in the dirBrowse parameter and trick an authenticated administrator into clicking the link. This could be accomplished through phishing emails, malicious websites, or by embedding the link in seemingly legitimate communications.

When the victim accesses the crafted URL while authenticated to the Zucchetti Axess device, the injected script executes within their browser session. The attacker's payload can then perform actions such as session cookie theft, DOM manipulation to change displayed information, or automatic submission of configuration changes using the victim's authenticated session.

The vulnerability requires no authentication on the part of the attacker and can affect any user who accesses the malicious link while having an active session on the vulnerable device. The scope is changed, meaning the vulnerability in the web application can impact resources beyond its security scope, affecting the user's browser environment.

Detection Methods for CVE-2026-30695

Indicators of Compromise

• Unusual or suspicious URL patterns in web server logs containing the /file_manager.cgi endpoint with encoded JavaScript or HTML tags in the dirBrowse parameter
• HTTP requests to the file manager endpoint containing common XSS payload signatures such as <script>, javascript:, onerror=, or onload=
• Unexpected session token transmissions to external domains from users accessing Zucchetti Axess web interfaces
• Reports from users of unexpected behavior when using the device's web management interface

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing XSS payload patterns targeting the /file_manager.cgi endpoint
• Enable detailed logging on the Zucchetti Axess devices and monitor for requests with suspicious characters in URL parameters
• Deploy network intrusion detection signatures that identify reflected XSS attack patterns in HTTP traffic destined for access control device management interfaces
• Utilize browser security tools and Content Security Policy (CSP) headers to prevent execution of inline scripts

Monitoring Recommendations

• Continuously monitor HTTP traffic to Zucchetti Axess device management interfaces for anomalous request patterns
• Set up alerts for authentication events originating from unexpected IP addresses or geographic locations following visits to the file manager endpoint
• Review access control configuration change logs for unauthorized modifications that may indicate post-exploitation activity
• Implement session monitoring to detect session hijacking attempts following potential XSS exploitation

How to Mitigate CVE-2026-30695

Immediate Actions Required

• Restrict network access to the Zucchetti Axess web management interface to trusted administrative networks only
• Implement network segmentation to isolate access control devices from general user networks
• Train administrators to recognize and avoid clicking suspicious links, especially those targeting device management interfaces
• Consider disabling the web-based configuration interface if not actively required and use alternative configuration methods

Patch Information

Organizations should contact Zucchetti directly for information about security patches or firmware updates that address this vulnerability. Monitor the vendor's security communications and the Zucchetti website for official patch releases. Additional technical information and proof-of-concept details are available in the GitHub CVE-2026-30695 PoC repository.

Workarounds

• Deploy a reverse proxy or web application firewall in front of the management interface to filter malicious input and block requests containing XSS payloads in the dirBrowse parameter
• Implement strict Content Security Policy headers on the management interface to prevent execution of inline scripts, if configurable
• Restrict access to the /file_manager.cgi endpoint to only essential personnel through IP whitelisting or VPN requirements
• Use browser extensions or security tools that help detect and block XSS attempts when accessing the management interface

Network administrators should implement firewall rules to restrict access to the management interface:

# Example iptables rules to restrict access to Zucchetti Axess management interface
# Allow access only from trusted admin network (adjust IP ranges as needed)
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP