Executive brief
The Beetel 450TC3 router's web management interface contains a stored cross-site scripting (XSS) vulnerability in the user management component. An authenticated user can inject malicious JavaScript code into the username field when creating new user accounts, which is then executed in the administrator's browser when they view the user list. This allows an attacker to hijack the administrator's session, modify router configuration, create or delete user accounts, and potentially compromise the entire device.
Technical details
A stored cross-site scripting (CWE-79) vulnerability exists in the Beetel 450TC3 user management interface where user-supplied input in the username field is not properly validated or sanitized before storage. An authenticated attacker with low-privilege user account access can inject malicious JavaScript payloads (e.g., <script>alert(`XSS`)</script>) when creating new user accounts. The payload is stored by the application and executed in the administrator's browser context when they access the user management page to view the user list. Attack requires authentication and user interaction (administrator viewing the user list), but can lead to arbitrary JavaScript execution with administrator privileges, enabling session hijacking, unauthorized configuration changes, and device compromise. No patch information is publicly available as the vendor did not respond to early disclosure.
Affected products
- Beetel 450TC3 01.00.00_01
Timeline
- 2026-08-30: disclosed