CVE-2013-2270: Cross-site scripting (XSS) vulnerability in the administration page in Airvana HubBub C1-600-RT and Sprint...

Security readout for executives and security teams

This CVE describes cross-site scripting in the administration page of Airvana HubBub C1-600-RT and Sprint AIRAVE 2.5 femtocell devices. An attacker could inject script or HTML into the admin interface. Business urgency depends on whether these legacy devices still exist and whether untrusted users can reach their administration pages. Exposure is most likely in environments still operating Airvana HubBub C1-600-RT or Sprint AIRAVE 2.5 devices with reachable web administration interfaces. The provided sources do not identify affected firmware versions or broad internet exposure. Prioritize discovery and containment over emergency response unless affected devices are exposed. This is an old XSS issue with no KEV signal in the bundle, but unsupported network appliances with admin interfaces can create outsized operational risk. Mitigation focus: Inventory for Airvana HubBub C1-600-RT and Sprint AIRAVE 2.5 devices.; Restrict administration pages to trusted management networks only.; Check vendor or carrier guidance for firmware updates or configuration mitigations..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.