Lucene search

Rapid7CVE-2023-5880

HistoryJan 03, 2024 - 8:15 p.m.

CVE-2023-5880

2024-01-0320:15:21

CWE-79

rapid7

web.nvd.nist.gov

genie company

aladdin connect

garage door opener

xss vulnerability

retrofit-kit

aldcm

cve-2023-5880

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users’ web browser.

Affected configurations

Nvd

Node

geniecompanyaladdin_connect_garage_door_opener_firmwareRange≤14.1.1

AND

geniecompanyaladdin_connect_garage_door_openerMatch-

VendorProductVersionCPE
geniecompanyaladdin_connect_garage_door_opener_firmware*cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware:*:*:*:*:*:*:*:*
geniecompanyaladdin_connect_garage_door_opener-cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
geniecompany	aladdin_connect_garage_door_opener_firmware	*	cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware::::::::
geniecompany	aladdin_connect_garage_door_opener	-	cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "RTOS"
    ],
    "product": "Aladdin Connect (Retrofit-Kit)",
    "vendor": "The Genie Company",
    "versions": [
      {
        "lessThanOrEqual": "<=14.1.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/