Cross Site Scripting Vulnerability in Teradek Sphere Firmware
CVE-2021-37379

5.4MEDIUM

Key Information:

Vendor

Teradek

Status
Sphere Firmware
Vendor
CVE Published:
3 February 2023

What is CVE-2021-37379?

A Cross Site Scripting (XSS) vulnerability exists in Teradek Sphere across all firmware versions. This security flaw allows remote attackers to execute arbitrary code through manipulation of the Friendly Name field found in the System Information Settings. Additionally, it's important to note that the vendor has declared the product as End of Life (EOL), meaning it will not receive any firmware updates to mitigate this vulnerability.

References

https://tbutler.org/2021/04/29/teradek-vulnerability-advi...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2021-37379 : Cross Site Scripting Vulnerability in Teradek Sphere Firmware