Stored Cross-Site Scripting Vulnerability in Multilaser RE 170
CVE-2023-36146

5.4MEDIUM

Key Information:

Vendor

Multilaser

Status
Re170 Firmware
Vendor
CVE Published:
30 June 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-36146?

A vulnerability in the Multilaser RE 170 device allows for Stored Cross-Site Scripting (XSS) attacks, potentially enabling attackers to inject malicious scripts into the device's interface. This could result in unauthorized access to sensitive user data or control over device operations. Users of the firmware version 2.2.6733 are advised to review security best practices to mitigate any risks associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-36146
Created by leonardobg

References

http://multilaser.com
https://github.com/leonardobg/CVE-2023-36146/#readme

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.