Cross site scripting

2020-01-2115:15:00

PRIOn knowledge base

www.prio-n.com

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Password).

CPENameOperatorVersion
th10_firmwareeq6.6.0.21
th16_firmwareeq6.6.0.21

CPE	Name	Operator	Version
	th10_firmware	eq	6.6.0.21
	th16_firmware	eq	6.6.0.21

References

sku11army.blogspot.com/2020/01/sonoff-sonoff-th-module-vuln-xss.html