CVE-2022-26962

Received Received - Intake

Multiple Stored XSS in Italtel NFV 11.1.2

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MITRE

Description

Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2022-26962

Affected Vendors & Products

Vendor	Product	Version / Range
italtel	nfv	11.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in Italtel NFV 11.1.2-20210318. It allows an attacker to inject malicious JavaScript code via parameters like name, username, or mrfAnnouncementName in the configuration page. The injected script executes when an authenticated user views the affected page.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users with access to the vulnerable system could have their credentials compromised or be exposed to further attacks through the injected scripts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and loss of user trust due to compromised personal or health information.

Mitigation Strategies

Update Italtel NFV to the latest version to address the XSS vulnerability. If an update is not available, restrict access to the affected configuration page NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS to trusted users only.

Hi! I’m here to help you understand CVE-2022-26962. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70