The vulnerability arises from Beghelli Sicuro24 SicuroWeb's use of AngularJS 1.5.2, an end‑of‑life framework that includes known sandbox‑escape primitives. When an attacker is able to inject a malicious template into the application, these primitives enable escape from the AngularJS sandbox, allowing arbitrary JavaScript execution within the operator’s browser session. The impact includes session hijacking, unauthorized DOM manipulation, and persistent compromise of the browser, effectively granting an attacker control over the client environment.

The affected product is Beghelli SicuroWeb, part of the Sicuro24 suite, with vendor name Beghelli. No specific version numbers are provided in the advisory; the flaw resides in any installation that embeds AngularJS 1.5.2 within the application.

The CVSS score of 9.3 reflects critical confidentiality, integrity, and availability damage if exploited. Attackers need only an opportunistic position in the same physical or logical network to perform a man‑in‑the‑middle attack on plaintext HTTP traffic, which does not require user interaction. Because the vulnerability operates purely within the client browser, it bypasses server‑side defenses, and the exploitation chain is fully client‑side, leaving only the network posture and firewall controls as mitigations. The lack of an EPSS score and absence from the CISA KEV catalog do not reduce the threat; the known exploitation chain and ease of delivery make this vulnerability a pressing risk in exposed environments.