CVE-2020-26801

MediumCVSS 5.4

Published: 25/06/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability was discovered in the TrippLite SU2200RTXL2Ua firmware version 12.04.0055 in the /Forms/device_vars_1 script. It allows authenticated attackers to inject malicious scripts via a crafted POST request, leading to theft of other users' data.

Risk Assessment

The risk involves potential session hijacking or leakage of sensitive information from other users, compromising data integrity and confidentiality within the organization.

Recommendation

Immediately update the TrippLite SU2200RTXL2Ua firmware to the latest version that fixes this vulnerability, and restrict administrative panel access to trusted users only.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request.