CVE-2026-82488
Received Received - Intake

Cross-Site Scripting in Beetel 450TC3 Router

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component User Management. The manipulation of the argument Username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82488
EUVD
EUVD-2026-68180

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
beetel 450tc3 01.00.00_01

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (Stored XSS) flaw in the Beetel 450TC3 router firmware version V01.00.00_01. It allows a low-privileged authenticated user to inject malicious JavaScript into the user management interface by entering a payload like <script>alert(`XSS`)</script> in the username field. The payload is stored by the application and executed when an administrator views the user list.

Detection Guidance

Check if the Beetel 450TC3 router is running firmware version V01.00.00_01. Log in as a low-privileged user and attempt to create a new user account with a username containing a payload like <script>alert(`XSS`)</script>. If the payload is stored and executed when an administrator views the user list, the vulnerability is present.

Impact Analysis

This vulnerability can lead to session hijacking, unauthorized administrative actions, or full device compromise. The malicious script executes in the administrator's browser session when accessing the user management page, potentially allowing attackers to take control of the router or steal sensitive information.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to the risk of unauthorized access and data breaches. Stored XSS may allow attackers to steal session cookies or sensitive data, leading to violations of confidentiality requirements under these regulations. The lack of input validation and output sanitization in the router's interface further exacerbates compliance risks by enabling persistent malicious scripts.

Mitigation Strategies

Update the router's firmware to the latest version if an update is available. Disable or restrict access to the user management interface from untrusted networks. Implement input validation to block special characters in the username field. Monitor network traffic for suspicious activity related to user account creation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart