CVE-2026-22323

HIGH EPSS 7.5%

Published Mar 18, 20263mo ago · Modified Jun 17, 20261w ago

7.1 CVSS 3.1

High

Published Mar 18, 2026 3mo ago

Last Modified Jun 17, 2026 1w ago

Description

A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter the device’s configuration without the victim’s knowledge or consent. Availability impact was set to low because after a successful attack the device will automatically recover without external intervention.

CVSS Details

Base Score

7.1

Exploitability

2.8

Impact

4.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity High

Availability Low

Threat Intelligence

EPSS Exploit Probability

7.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

References 1

certvde.com https://certvde.com/de/advisories/VDE-2025-104

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.