CVE-2026-6624

OVERVIEW: CVE-2026-6624 is a cross-site scripting (XSS) vulnerability in BichitroGan ISP Billing Software version 2025.3.20, specifically within the Pool List Interface component accessible via the /?_route=pool/add endpoint. The vulnerability allows attackers to execute malicious scripts through manipulation of an unidentified function within this administrative interface. SEVERITY: The vulnerability carries a CVSS score of 2.4 (LOW) and requires high-level privileges and user interaction to exploit, limiting its immediate risk. However, it does present a path to integrity compromise through reflected XSS attacks. The attack vector is network-based with low complexity, though the scope and confidentiality impact remain minimal. The FAUCET Risk Score of 33.0/100 suggests moderate concern within the broader security context. EXPLOITATION STATUS: While exploit code has been publicly disclosed, the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and demonstrates minimal exploitation likelihood based on an EPSS score of 0.000280000. However, the vulnerability remains on active watch lists, indicating continued community monitoring. The vendor's lack of response to early disclosure notifications compounds remediation challenges for affected organizations.