VulnerabilityModified

CVE-2020-22158

MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS.

MEDIUM 6.1EPSS 0.66%

Does this matter?

Lower severity and a low EPSS score (0.66%). Track it; it rarely justifies an emergency change on its own.

Description

MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker must modify the "name" parameter with the malicious code.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.66% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: mediakind/rx8200 firmware
Source: cve@mitre.org

References

https://sku11army.blogspot.com/2020/02/ericsson-multiple-stored-reflected-xss.htmlPermissions Required
https://sku11army.blogspot.com/2020/02/ericsson-multiple-stored-reflected-xss.htmlPermissions Required

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.