CVE-2023-5880

2024-01-0320:15:21

CWE-79

[email protected]

web.nvd.nist.gov

genie company

aladdin connect

garage door opener

xss

vulnerability

web servers

broadcast ssid

malicious code

client side

javascript

html

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users’ web browser.

Affected configurations

Nvd

Node

geniecompanyaladdin_connect_garage_door_opener_firmwareRange≤14.1.1

AND

geniecompanyaladdin_connect_garage_door_openerMatch-

VendorProductVersionCPE
geniecompanyaladdin_connect_garage_door_opener_firmware*cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware:*:*:*:*:*:*:*:*
geniecompanyaladdin_connect_garage_door_opener-cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
geniecompany	aladdin_connect_garage_door_opener_firmware	*	cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware::::::::
geniecompany	aladdin_connect_garage_door_opener	-	cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:::::::*