Reflected XSS in ABB EIBPORT V3 KNX and EIBPORT V3 KNX GSM

Successful exploitation could allow attacker-supplied script to execute in the victim's browser within the security context of the affected EIBPORT web application. Depending on the victim's session and privileges, this may enable session theft, credential capture, unauthorized actions performed on behalf of the user, manipulation of displayed content, or redirection to attacker-controlled content. The provided content does not specify any server-side code execution or direct device compromise.

If immediate upgrading is not possible, reduce exposure of the EIBPORT web interface to untrusted networks, restrict access to trusted administrative users only, and minimize opportunities for users to follow untrusted links to the device interface. Administrators should monitor for suspicious requests targeting the web UI and follow ABB's published mitigations and cybersecurity advisory guidance. The provided content does not include more specific vendor mitigation details.

Upgrade ABB EIBPORT V3 KNX and ABB EIBPORT V3 KNX GSM to version 3.9.2 or later, as the provided content states that versions prior to 3.9.2 are affected. Review ABB's security advisory and associated vendor guidance for any product-specific update procedures or additional hardening recommendations.