Cross site scripting

2019-03-2116:00:00

PRIOn knowledge base

www.prio-n.com

6 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON

HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.

CPENameOperatorVersion
netbiter_ec150_firmwarele1.40.0
netbiter_ec250_firmwarele1.40.0
netbiter_lc310_firmwarele3.30.5
netbiter_lc310_thingworx_firmwarele2.00.07
netbiter_lc350_firmwarele2.00.07
netbiter_lc350_thingworx_firmwarele2.00.07
netbiter_ws100_firmwarele3.30.5
netbiter_ws200_firmwarele3.30.4

Name	Operator	Version
netbiter_ec150_firmware	le	1.40.0
netbiter_ec250_firmware	le	1.40.0
netbiter_lc310_firmware	le	3.30.5
netbiter_lc310_thingworx_firmware	le	2.00.07
netbiter_lc350_firmware	le	2.00.07
netbiter_lc350_thingworx_firmware	le	2.00.07
netbiter_ws100_firmware	le	3.30.5
netbiter_ws200_firmware	le	3.30.4

References

packetstormsecurity.com/files/151119/HMS-Netbiter-WS100-3.30.5-Cross-Site-Scripting.html

seclists.org/bugtraq/2019/Jan/9

www.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2018-12-04-001-ec150-ec250-lc310-lc350-ws100-ws200-cve-2018-19694.pdf

www.netbiter.com/products