A reflected Cross‑Site Scripting vulnerability exists in the web‑based configuration interface of Zucchetti Axess access control devices. The flaw is caused by inadequate sanitization of the dirBrowse parameter in the /file_manager.cgi endpoint, allowing an attacker to inject arbitrary script code that executes in the view of an authenticated administrator. This CWE‑79 weakness could lead to session hijacking, credential theft, or unauthorized configuration changes.

The issue affects multiple Zucchetti Axess models, including XA4, X3/X3BIO, X4, X7, and the XIO / i‑door / i‑door+ series. No specific firmware or version numbers are provided, so any device within these product lines should be considered potentially vulnerable until verified.

The CVSS score of 6.1 indicates moderate severity; the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the web interface, accessed remotely by an authenticated administrator, though this is inferred rather than explicitly stated. Successful exploitation could compromise configuration integrity and provide a foothold for further network attacks.