Lucene search

K
vulnrichmentCERT-InVULNRICHMENT:CVE-2023-51722
HistoryJan 17, 2024 - 6:52 a.m.

CVE-2023-51722 Stored Cross Site Scripting Vulnerability in Skyworth Router

2024-01-1706:52:36
CWE-79
CERT-In
github.com
1
cross site scripting
skyworth router
vulnerability
remote attacker
validation
input
web interface
exploitation

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

5.9

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Time Server 3 parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system.

Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

5.9

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

Related for VULNRICHMENT:CVE-2023-51722