CVE-2026-41468 Details

A vulnerability in Beghelli Sicuro24's web management interface, SicuroWeb, allows for arbitrary JavaScript execution in operator browser sessions. This issue arises from an AngularJS template injection vulnerability, combined with a known sandbox escape in AngularJS version 1.5.2, which is embedded in the application. The vulnerability enables session hijacking, DOM manipulation, and a persistent compromise of the browser. Network-adjacent attackers can exploit this vulnerability by injecting the necessary payloads into the victim's browser via a Man-in-the-Middle (MITM) attack, taking advantage of unencrypted HTTP communications.

As of now, no patch is available for this vulnerability. However, it is recommended to upgrade AngularJS to version 1.6 or later, deploy a restrictive Content Security Policy, enforce HTTPS with HSTS, sanitize template rendering to prevent user input from being evaluated as code, and segment networks to restrict access to management interfaces.