FS S3150-8T2F Switch Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in FS model S3150-8T2F switches. This issue arises in devices running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2. The vulnerability allows an authenticated user of the web interface to bypass input filtering on usernames, leading to the storage of un-sanitized HTML and JavaScript on the device. When pages display the username without properly encoding special characters, the injected code is executed in the browsers of other users accessing the web interface.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.