CVE-2023-5880 Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name

2024-01-0319:16:44

CWE-79

rapid7

www.cve.org

cve-2023-5880

cross-site scripting

aladdin connect

garage door

retrofit-kit

configuration

webserver

ssid

vulnerability

xss attack

java script

html

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users’ web browser.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "RTOS"
    ],
    "product": "Aladdin Connect (Retrofit-Kit)",
    "vendor": "The Genie Company",
    "versions": [
      {
        "lessThanOrEqual": "<=14.1.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]