Description
An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.
Published: 2026-07-17
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated reflected cross‑site scripting vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (build 104997). The portal parameter passed to the invalid_browser and invalid_browser_login handlers is not sanitized, causing user‑supplied data to be reflected directly into JavaScript generated by the application. This enables an attacker to execute arbitrary script code within a victim’s browser session.

Affected Systems

Sangoma Switchvox SMB Edition 8.3 (build 104997).

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity vulnerability. An attacker can exploit it via an unauthenticated web request by crafting a URL with a malicious portal parameter that targets the vulnerable endpoints and causes the victim’s browser to run injected JavaScript. The EPSS score of less than 1% reflects a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 1, 2026 at 08:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify the latest Switchvox SMB Edition release notes or contact Sangoma support to determine if a patch addressing the portal parameter sanitization flaw has been released, and upgrade to that version when available.
  • Until a patch is available, configure a web application firewall to block requests to the invalid_browser and invalid_browser_login endpoints that contain suspicious or malicious portal parameter content.
  • If the application includes custom extensions or user input handling, implement strict input validation and output encoding for the portal parameter to prevent reflected JavaScript injection.

Generated by OpenCVE AI on August 1, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Sangoma
Sangoma switchvox Smb Edition
Vendors & Products Sangoma
Sangoma switchvox Smb Edition

Fri, 17 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.
Title Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L'}

Subscriptions

Sangoma Switchvox Smb Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: SRA

Published:

Updated: 2026-07-17T16:39:14.113Z

Reserved: 2026-05-26T13:03:29.116Z

Link: CVE-2026-9585

cve-icon Vulnrichment

Updated: 2026-07-17T16:39:10.182Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T08:30:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')