CVE-2026-7026 — Some Unknown Processing Of The Component System Information Vulnerability

title: Cross-Site Scripting in D-Link DGS-3420 System Information Settings — CVE-2026-7026
id: scw-2026-04-26-ai-1
status: experimental
level: medium
description: |
  This rule detects a specific Cross-Site Scripting (XSS) attempt targeting the D-Link DGS-3420 switch. The vulnerability (CVE-2026-7026) lies in the 'System Information Settings Page' where manipulation of the 'System Name' argument can lead to XSS. This detection looks for the specific URI path and a common XSS payload injected into the 'SystemName' parameter, indicating an attempt to exploit this vulnerability for initial access.
author: SCW Feed Engine (AI-generated)
date: 2026-04-26
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7026/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/cgi-bin/webproc?getpage=html/sysinfo.html'
      cs-uri-query|contains:
          - 'SystemName=<script>alert(1)</script>'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse