CVE-2021-35956: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enabl...

Security readout for executives and security teams

AKCP sensorProbe devices with firmware before SP480-20210624 can store malicious JavaScript in several configuration fields. Because the issue requires authenticated access, it is not described as an unauthenticated internet takeover, but it could still compromise administrator sessions or device management workflows. Organizations using AKCP sensorProbe environmental monitoring devices are potentially exposed if firmware predates SP480-20210624 and the management interface is reachable by users beyond a tightly controlled admin group. Treat this as a targeted administration-plane risk. Prioritize devices exposed to broad internal networks or the internet, then update firmware and tighten management access. Mitigation focus: Upgrade affected sensorProbe firmware to SP480-20210624 or later if vendor guidance confirms applicability.; Restrict access to the embedded webserver to trusted administrative networks.; Review AKCP firmware changelog and support guidance for model-specific update instructions..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.