VulnerabilityAnalyzed
CVE-2022-39996
Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page.
MEDIUM 4.8EPSS 0.34%
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- teldat/rs123 firmware · teldat/rs123w firmware
- Source
- cve@mitre.org
References
- https://github.com/uyhacked/Teldat-s-Router/blob/main/TeldatBroken Link
- https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat%27s%20Router%20Vulnerability.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.