OpenWrt Cross-Site Scripting Vulnerability

OpenWrt is a Linux operating system for embedded devices. A cross-site scripting vulnerability exists in OpenWrt version 18.06.4, which stems from the lack of proper validation of client-side data by a WEB application. An attacker can exploit this vulnerability to execute client-side code...

PT-2019-15743 · Tp Link +1 · Tp-Link Archer C7 +1

Name of the Vulnerable Software and Affected Versions: OpenWrt version 18.06.4 Description: The issue allows for XSS via the Name fields in the /cgi-bin/luci/admin/network/firewall/rules API endpoint, specifically in the "Open ports on router", "New forward rule", and "New Source NAT" fields. Thi...