Lucene search

CERT-InCVELIST:CVE-2023-51723

HistoryJan 17, 2024 - 6:54 a.m.

CVE-2023-51723 Stored Cross Site Scripting Vulnerability in Skyworth Router

2024-01-1706:54:46

CWE-79

CERT-In

www.cve.org

cve-2023-51723

stored cross site scripting

skyworth router

insufficient validation

user supplied input

remote attacker

web interface

specially crafted input

exploitation

xss attacks

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Description parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system.

Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Skyworth Router CM5100",
    "vendor": "Hathway",
    "versions": [
      {
        "lessThanOrEqual": "4.1.1.24",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0013

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

Related for CVELIST:CVE-2023-51723