Lucene search

PRIOn knowledge basePRION:CVE-2023-34354

HistoryOct 11, 2023 - 4:15 p.m.

Cross site scripting

2023-10-1116:15:00

PRIOn knowledge base

www.prio-n.com

cross site scripting

upload brand

vulnerability

execution

arbitrary javascript

http request

authenticated

5.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.4%

JSON

A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to execution of arbitrary javascript in another user’s browser. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CPENameOperatorVersion
surf_soho_firmwareeq6.3.5

CPE	Name	Operator	Version
	surf_soho_firmware	eq	6.3.5

References

talosintelligence.com/vulnerability_reports/TALOS-2023-1781