Cross-Site Scripting Vulnerability in Askey RTF8115VW Router
CVE-2021-27403

6.1MEDIUM

Key Information:

Vendor
Asus
Status
Askey Rtf8115vw Firmware
Vendor
CVE Published:
19 February 2021

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The devices known as Askey RTF8115VW are susceptible to a Cross-Site Scripting (XSS) vulnerability through the web management interface located at cgi-bin/te_acceso_router.cgi. This issue arises when user input is not properly sanitized, allowing attackers to inject malicious scripts. If exploited, an attacker can potentially manipulate the web interface, gaining unauthorized access to sensitive information or performing actions on behalf of the user.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-27403
Created by bokanrb

References

https://github.com/bokanrb/XSS-Askey
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.