CVE-2022-35416

Deeper analysis

CVE-2022-35416 is a reflected cross-site scripting vulnerability (CWE-79) affecting H3C SSL VPN products through 10 July 2022. The flaw resides in the handling of the svpnlang cookie parameter passed to the wnm/login/login.json endpoint, allowing an attacker-supplied script to be reflected back to the victim without adequate output encoding or input validation. The issue carries a CVSS 3.1 base score of 6.1.

An unauthenticated remote attacker can exploit the weakness by inducing a victim to visit a malicious link or by delivering a crafted cookie value through another channel. Successful exploitation results in execution of arbitrary JavaScript in the context of the victim’s browser session, enabling theft of session tokens, redirection to attacker-controlled sites, or limited modification of page content.

Public proof-of-concept code demonstrating cookie-based payload delivery has been published on GitHub. The associated EPSS score has remained low, with a current value of 0.0663 and a peak of 0.0678, indicating limited observed exploitation interest since disclosure. No vendor advisory or official patch information appears among the available references.