Lucene search

CERT-InCVELIST:CVE-2023-51727

HistoryJan 17, 2024 - 7:01 a.m.

CVE-2023-51727 Stored Cross Site Scripting Vulnerability in Skyworth Router

2024-01-1707:01:22

CWE-79

CERT-In

www.cve.org

vulnerability

stored xss

skyworth router

cm5100

version 4.1.1.24

insufficient validation

user input

smtp username

remote attacker

web interface

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Username parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system.

Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Skyworth Router CM5100",
    "vendor": "Hathway",
    "versions": [
      {
        "lessThanOrEqual": "4.1.1.24",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0013

CVSS3

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

Related for CVELIST:CVE-2023-51727