Cross-Site Scripting (XSS) in AJA HELO Plus firmware (CVE-2026-47096)
Summary
Cross-site scripting in AJA HELO Plus firmware (CVE-2026-47096). Risk of unauthorized operations or information disclosure.
Original description
The description as published by the source.
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. Attackers can exploit this flaw when device authentication is disabled to persistently execute arbitrary script in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-47096 has been found in AJA HELO Plus firmware.
Risk of unauthorized operations or information disclosure. CVSS score: 6.1/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "AJA HELO Plus firmware CVE-2026-47096" on the vendor's site.
CVE-2026-47096 (AJA HELO Plus firmware) — CWE-79 / CVSS v3 6.1
Attack vector: remote (network-reachable) / unauthenticated
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Cross-site scripting (XSS) (CWE-79) exists in AJA HELO Plus firmware.
Check the vendor advisory for the affected versions of AJA HELO Plus firmware.
Severity: Medium (CVSS 6.1/10). Risk of unauthorized operations or information disclosure.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで AJA HELO Plus firmware を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- web d26ddnfpy9hzf8.cloudfront.net
- web aja.com
- web aja.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com