Stored Cross-Site Scripting
CVE-2023-4202

9CRITICAL

Key Information:

Vendor
Advantech
Status
Eki-1524
Eki-1522
Eki-1521
Vendor
CVE Published:
8 August 2023

Summary

Advantech EKI-1524, EKI-1522, and EKI-1521 devices running versions up to 1.21 are susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises when an authenticated user inputs malicious scripts into the device name field via the web interface. Successful exploitation allows attackers to execute harmful scripts in the context of users viewing the device's information, potentially leading to further security breaches and data compromise.

Affected Version(s)

EKI-1521 0 <= 1.21

EKI-1522 0 <= 1.21

EKI-1524 0 <= 1.21

References

https://cyberdanube.com/en/en-st-polten-uas-multiple-vuln...
third-party-advisoryexploit
http://seclists.org/fulldisclosure/2023/Aug/13
http://packetstormsecurity.com/files/174153/Advantech-EKI...

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

R. Haas
A. Resanovic
T. Etzenberger
M. Bineder
.