Multiple cross-site scripting (XSS) vulnerabilities in AirMagnet Enterprise before 7.5…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via (1) the 404 error page of the Smart Sensor Edge Sensor; (2) the user name for a failed logon, when displayed in the audit journals reviewing interface (/AirMagnetSensor/AMSensor.dll/XH) by the Smart Sensor Edge Sensor log viewer; and (3) an SSID of an AP, when displayed on an ACL page (/Amom/Amom.dll/BD) of the Enterprise Server Status Overview in the Enterprise Server Web interface.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-5741
- 2026-10-03 Alias added: GHSA-h67g-v778-vp3r
More Airmagnet Enterprise vulnerabilities
- TI-2006-05531 The console in AirMagnet Enterprise before 7.5 build 6307 does not properly validate the… CVSS 2.0MEDIUM 6.4
- TI-2006-05527 The AirMagnet Enterprise console and Remote Sensor console (Laptop) in AirMagnet… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2006-5741 · CVE Program
- CVE-2006-5741 · NVD
- FIRST EPSS
- GHSA-h67g-v778-vp3r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences