Cross-Site Scripting Vulnerability in BDCOM OLT P3310D-2AC Web Interface
CVE-2023-39678

6.1MEDIUM

Key Information:

Vendor

Bdcom

Status
P3310d-2ac Firmware
Vendor
CVE Published:
29 August 2023

What is CVE-2023-39678?

A cross-site scripting (XSS) vulnerability exists in the web interface of the BDCOM OLT P3310D-2AC. This issue allows attackers to execute arbitrary web scripts or HTML by injecting malicious payloads into the username parameter on the Log Query page. By exploiting this vulnerability, an attacker could potentially perform actions that compromise the security of the device and its data.

References

https://telegra.ph/XSS-in-BDCOM-OLT-P3310D-2AC-07-29

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.