VulnerabilityModified
CVE-2023-49258
User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter.
MEDIUM 6.1EPSS 0.34%
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- hongdian/h8951-4g-esp firmware
- Source
- cvd@cert.pl
References
- https://cert.pl/en/posts/2024/01/CVE-2023-49253/Third Party Advisory
- https://cert.pl/posts/2024/01/CVE-2023-49253/Third Party Advisory
- https://cert.pl/en/posts/2024/01/CVE-2023-49253/Third Party Advisory
- https://cert.pl/posts/2024/01/CVE-2023-49253/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.