Read the docs
TI-2022-06559 Aliases CVE-2022-22229GHSA-h8xr-vrcj-c52v

Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00832 57th percentileScored 2026-11-07
Fix Fixed Paragon Active Assurance (Formerly Netrounds) (Juniper Networks): 3.1.1, 3.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperParagon Active Assurance (Formerly Netrounds)before 3.1.1; 3.2 to before 3.2.13.1.1, 3.2.1Patch availableCNA
  • Paragon Active Assurance (Formerly Netrounds) VendorJuniper Affected before 3.1.1; 3.2 to before 3.2.1 Fixed in 3.1.1, 3.2.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:juniper:paragon_active_assurance_control_center:*:*:*:*:*:*:*:*before 3.1.1VulnerableJuniper
cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableJuniper
  • cpe:2.3:a:juniper:paragon_active_assurance_control_center:*:*:*:*:*:*:*:* Versions before 3.1.1 Vulnerable ·Juniper
  • cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Juniper

Remediation

  • Fix · CNA Paragon Active Assurance (Formerly Netrounds) (Juniper Networks) Fixed in 3.1.1, 3.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22229
  2. 2026-10-03 Alias added: GHSA-h8xr-vrcj-c52v

References

Advisory 1

  • TI-2024-14317 Paragon Active Assurance Control Center: Information disclosure vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-20117 Paragon Active Assurance: probe_serviced exposes internal objects to local users CVSS 4.0HIGH 8.4
  • TI-2022-06523 Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL CVSS 3.1HIGH 7.5
  • TI-2021-00166 Paragon Active Assurance: Authentication bypass vulnerability in Control Center CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences