Reflected XSS issues in GateManager
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session.
Why it matters now
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed GateManager (Secomea): 9.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Secomea | GateManager | before 9.7 | 9.7 | Patch available | CNA |
- GateManager VendorSecomea Affected before 9.7 Fixed in 9.7 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:* | before 9.7.622134021 | Vulnerable | Secomea |
| cpe:2.3:h:secomea:gatemanager_4250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Secomea |
| cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:* | before 9.7.622134021 | Vulnerable | Secomea |
| cpe:2.3:h:secomea:gatemanager_4260:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Secomea |
| cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:* | before 9.7.622134021 | Vulnerable | Secomea |
| cpe:2.3:h:secomea:gatemanager_8250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Secomea |
| cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:* | before 9.7.622134021 | Vulnerable | Secomea |
| cpe:2.3:h:secomea:gatemanager_9250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Secomea |
- cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:* Versions before 9.7.622134021 Vulnerable ·Secomea
- cpe:2.3:h:secomea:gatemanager_4250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Secomea
- cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:* Versions before 9.7.622134021 Vulnerable ·Secomea
- cpe:2.3:h:secomea:gatemanager_4260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Secomea
- cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:* Versions before 9.7.622134021 Vulnerable ·Secomea
- cpe:2.3:h:secomea:gatemanager_8250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Secomea
- cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:* Versions before 9.7.622134021 Vulnerable ·Secomea
- cpe:2.3:h:secomea:gatemanager_9250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Secomea
Remediation
- Fix · CNA GateManager (Secomea) Fixed in 9.7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Secomea GateManager 9.7
9 records Highest priority Priority LOW 9 LOW
Other records, highest priority first
- TI-2022-09350 Unload handlers may unintentionally defeat CSRF guardsPriority LOW 38
- TI-2021-11990 Clients may connect to a GateManager with TLS 1.0Priority LOW 35
- TI-2022-09359 GTA URLs issued by LMM WEB API may leak informationPriority LOW 32
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25781
- 2026-10-03 Alias added: GHSA-r4mf-x9jp-4g78
References
More Secomea Gatemanager 4250 Firmware vulnerabilities
- TI-2020-17532 Path traversal in Secomea GateManager CVSS 3.1CRITICAL 9.0
- TI-2022-09350 Unload handlers may unintentionally defeat CSRF guards CVSS 3.1HIGH 8.8
- TI-2020-17537 Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation CVSS 3.1HIGH 8.1
- TI-2021-11990 Clients may connect to a GateManager with TLS 1.0 CVSS 3.1HIGH 8.1
- TI-2022-09359 GTA URLs issued by LMM WEB API may leak information CVSS 3.1HIGH 7.5
- TI-2020-17528 Host Header Injection allowing web cache poisoning attacks CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-25781 · CVE Program
- CVE-2022-25781 · NVD
- FIRST EPSS
- GHSA-r4mf-x9jp-4g78 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences