CVE-2014-1902

Description

Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.

CVSS 2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.78% probability · 54th percentile

CISA KEV

Not listed

Weakness

CWE-79

Affected

y-cam/ycb004 firmware · y-cam/ycb002 firmware · y-cam/yck002 firmware · y-cam/yck003 firmware · y-cam/yceb03 firmware · y-cam/ycb001 firmware · y-cam/ycblhd5 firmware · y-cam/ycblb3 firmware · y-cam/ycblb3 · y-cam/ycb003 firmware · y-cam/ycw003 firmware · y-cam/ycw004 firmware · y-cam/ycw004 · y-cam/ycbl03 firmware · y-cam/ycbl03 · y-cam/yck004 firmware · y-cam/ycw001 firmware · y-cam/ycw002 firmware

Source

cve@mitre.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.