cross-site scripting vulnerability. 3com switch 4210

[mrussell]

I have a HP / 3com 4210 18 port switch on my network, which failed PCI compliance due to a cross site scripting vulnerability  via the web interface.

Is there a firmware fix for this? If not, is it possible to disable the web interface or port 80?

Any suggestions apperciated

thanks

[Fredrik Lönnman]

Hi,

You can restrict access to the web gui via ip http acl <acl> or disable it with undo ip http in system-view.

Regards

Fredrik

[mrussell]

Thanks Fredrik, that's exactly what i was loking for. I connected via CLI, went to system-view and entered undo ip http shutdown, and it disabled the web service.