Lucene search

CERT-InCVELIST:CVE-2023-51728

HistoryJan 17, 2024 - 7:02 a.m.

CVE-2023-51728 Stored Cross Site Scripting Vulnerability in Skyworth Router

2024-01-1707:02:31

CWE-79

CERT-In

www.cve.org

cve-2023-51728

skyworth router

stored cross site scripting

vulnerability

remote attacker

validation

web interface

smtp password

exploitation

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Password parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system.

Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Skyworth Router CM5100",
    "vendor": "Hathway",
    "versions": [
      {
        "lessThanOrEqual": "4.1.1.24",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0013

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

Related for CVELIST:CVE-2023-51728