When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users’ web browser.
[
{
"cpes": [
"cpe:2.3:a:geniecompany:aladdin_connect:*:*:*:*:*:android:*:*"
],
"vendor": "geniecompany",
"product": "aladdin_connect",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "14.1.1"
}
],
"defaultStatus": "unknown"
}
]