Radware Alteon 34.5.4.0 vADC load‑balancer contains a reflected Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into responses returned to a user. The injected scripts can execute in the victim’s browser, potentially enabling cookie theft, session hijacking, or execution of further malicious code. The vulnerability is a reflected XSS and could be exploited through crafted URLs or form submissions that pass through the load balancer.

The flaw affects Radware’s Alteon vADC load‑balancer running version 34.5.4.0. Any deployment of this specific version is at risk until a newer, patched release is applied.

No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog; however, reflected XSS is widely exploitable through normal web traffic. Attackers can trigger the vulnerability by sending a crafted request to the load balancer, making the risk moderate to high, especially if users are permitted to input arbitrary data that the balancer reflects. The absence of an official fix in the provided data means the compromise remains possible until remediation is applied.