It has been identified that the vulnerable endpoint doesn't have server side input validation and lacks client side filtering for any malicious script injection. An attacker can use this vulnerability to inject malicious script in the endpoint and the script is activated every time a user opens the vulnerable endpoint. Attackers can perform malicious operations using this vulnerability to take over the device and finally, to take over the network.
Researcher: Sayli Ambure (https://twitter.com/sayli_ambure)
MITRE CVE link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35262
Parameter: Server
Parameter: Keyword
