Cross site scripting

2022-02-2419:15:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.3%

JSON

The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within the web interface that, when executed, could modify some string values on the homepage of the web interface.

CPENameOperatorVersion
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarege4.001
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarele4.005
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarege5.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarele5.017
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmwareeq6.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmwareeq6.012

Name	Operator	Version
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	ge	4.001
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	le	4.005
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	ge	5.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	le	5.017
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmware	eq	6.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmware	eq	6.012

References

www.cisa.gov/uscert/ics/advisories/icsa-21-063-01