Cross site scripting

2020-01-0917:15:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.2%

JSON

XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.

CPENameOperatorVersion
sg600_r2_firmwareeq3.2 rc6

CPE	Name	Operator	Version
	sg600_r2_firmware	eq	3.2 rc6

References

github.com/InnotecSystem/Device-Reversing/wiki/XSS-Injection-via-DHCP-requests