CVE-2018-25034

Опубликовано: 12 июн. 2022

Источник: nvd

CVSS3: 3.5

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /goform/wlanPrimaryNetwork. The manipulation of the argument ServiceSetIdentifier with the input > as part of POST Request leads to basic cross site scripting (Persistent). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-126695.

Ссылки

https://alquimistadesistemas.com/auditando-router-thomson-tcw710
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.126695
Third Party Advisory
https://vuldb.com/?id.126695
Third Party Advisory
https://alquimistadesistemas.com/auditando-router-thomson-tcw710
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.126695
Third Party Advisory
https://vuldb.com/?id.126695
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:technicolor:thomson_tcw710_firmware:st5d.10.05:*:*:*:*:*:*:*

cpe:2.3:h:technicolor:thomson_tcw710:-:*:*:*:*:*:*:*

EPSS

Процентиль: 49%

0.00263

Низкий

3.5 Low

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-80

CWE-79

Связанные уязвимости

GHSA-qprw-hc7p-66cj

CVSS3: 5.4

github

больше 3 лет назад

A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /goform/wlanPrimaryNetwork. The manipulation of the argument ServiceSetIdentifier with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

EPSS

Процентиль: 49%

0.00263

Низкий

3.5 Low

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-80

CWE-79