Stored XSS Vulnerability in FiberHome VDSL2 Modem
CVE-2021-41946

5.4MEDIUM

Key Information:

Vendor
Fiberhome
Status
Hg150-ub Firmware
Vendor
CVE Published:
18 May 2022

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A stored cross-site scripting (XSS) vulnerability exists in the FiberHome VDSL2 Modem HG150-Ub_V3.0. This vulnerability is found in the Parental Control section, specifically within the Access Time Restriction's Username field. Due to this XSS flaw, users are unable to delete access rules, potentially leading to unauthorized access or manipulation of parental control settings.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-41946
Created by afaq1337

References

http://www.fiberhome.com/
x_refsource_MISC
https://github.com/afaq1337/CVE-2021-41946
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.