CVE-2026-6371: Stored XSS in Limatek LimRAD NAC – Patch Version 5.5.7.3.9

Technical summary

CVE-2026-6371 is a stored XSS vulnerability (CWE-79) in LimRAD NAC versions before 5.5.7.3.9. The vulnerability stems from improper input sanitization during web page generation. An attacker with local network access and valid credentials can inject JavaScript payloads that are stored server-side and reflected to subsequent users. The attack vector is adjacent network (AV:A), requires low complexity (AC:L), needs low privilege access (PR:L), and depends on user interaction (UI:R). The impact is limited to confidentiality and integrity compromise with no availability impact, reflected in the CVSS 3.1 score of 4.8 (MEDIUM severity).

Business impact

Stored XSS in a network access control appliance creates operational risk by potentially allowing attackers to escalate privileges, steal administrative session tokens, redirect users to malicious sites, or deface the management interface. Since NAC systems control network access policies and device onboarding, compromise could undermine the entire network segmentation strategy. Organizations relying on LimRAD for access enforcement should treat this as a control-plane integrity issue requiring prompt remediation.

Affected systems

Limatek System Inc. LimRAD NAC versions prior to 5.5.7.3.9 are affected. Organizations running LimRAD as their network access control solution should audit their deployment version immediately. No other vendors or products are listed as affected by this specific vulnerability.

Exploitability

Exploitation requires an attacker to already possess valid credentials and be on the same network segment as the LimRAD appliance (adjacent network access). This substantially lowers real-world risk in well-segmented environments but remains concerning in shared network scenarios or for insider threats. The need for user interaction means the attacker must either trick an administrator into viewing a malicious page or wait for routine administrative access. There is no evidence this vulnerability is being actively exploited in the wild, and it has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade LimRAD NAC to version 5.5.7.3.9 or later. Organizations unable to patch immediately should restrict administrative access to the LimRAD web interface to trusted networks, disable unnecessary user accounts, and enforce strong authentication. Consider deploying Web Application Firewall (WAF) rules to block common XSS payloads if direct patching is delayed.

Patch guidance

Verify the current version of your LimRAD NAC deployment via the administrator console or system configuration page. Limatek System Inc. should provide patched builds at version 5.5.7.3.9 or above. Consult the vendor's official advisory for upgrade procedures, as network access control appliances typically require coordinated maintenance windows. Test patches in a non-production environment before deployment to ensure compatibility with your network policies and device workflows.

Detection guidance

Monitor LimRAD web server logs for unusual characters or script tags in HTTP request parameters and POST bodies (e.g., <script>, onerror=, javascript:). Review the activity logs for administrative accounts making changes to web content or user interface templates. Inspect the browser console of the LimRAD management interface for unexpected JavaScript errors or console warnings that may indicate injected code. Organizations with SIEM integration can create alerts for HTTP requests containing common XSS vectors submitted to the LimRAD appliance.

Why prioritize this

Although the CVSS score is MEDIUM (4.8), prioritize this vulnerability if LimRAD is internet-facing or accessible from untrusted network segments, or if you have high-privilege administrative accounts that could be compromised. If LimRAD is strictly isolated to a trusted administrative network with strong access controls, prioritize it after critical and high-severity vulnerabilities affecting your external-facing systems. The stored nature of the XSS means it poses persistent risk once injected.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects the restricted attack vector (adjacent network only, not network-wide), requirement for prior authentication, low-complexity exploitation, and limited scope of impact. Confidentiality and integrity are partially compromised, but availability remains unaffected. In isolated network environments, this score appropriately reflects low urgency; however, organizations with less mature network segmentation should consider the risk higher in practice.

Frequently asked questions