Lucene search

[email protected]CVE-2024-0554

HistoryJan 16, 2024 - 11:15 a.m.

CVE-2024-0554

2024-01-1611:15:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2024-0554

cross-site scripting

xss

wic1200

vulnerability

authenticated user

malicious javascript

session details

nvd

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.5%

JSON

A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could store a malicious javascript payload in the device model parameter via ‘/setup/diags_ir_learn.asp’, allowing the attacker to retrieve the session details of another user.

Affected configurations

Vulners

NVD

Node

full_compass_systemswic1200Range≤1.1

CPENameOperatorVersion
xantech:wic1200_firmwarexantech wic1200 firmwareeq1.1

CPE	Name	Operator	Version
xantech:wic1200_firmware	xantech wic1200 firmware	eq	1.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "WIC1200",
    "vendor": "Full Compass Systems",
    "versions": [
      {
        "status": "affected",
        "version": "1.1"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-full-compass-systems-wic1200