CVE-2024-23786
Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product.
- CVSS 3.1
- 9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- EPSS
- 0.79% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- sharp/jh-rvb1 firmware · sharp/jh-rv11 firmware
- Source
- vultures@jpcert.or.jp
References
- https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdfVendor Advisory
- https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdfVendor Advisory
- https://jvn.jp/en/vu/JVNVU94591337/Third Party Advisory
- https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdfVendor Advisory
- https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdfVendor Advisory
- https://jvn.jp/en/vu/JVNVU94591337/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.