Описание
An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:o:rletech:fds-pc_firmware:2.1:*:*:*:*:*:*:*
cpe:2.3:h:rletech:fds-pc:-:*:*:*:*:*:*:*
Конфигурация 2
Одновременно
cpe:2.3:o:rletech:fds-pc-dp_firmware:2.1:*:*:*:*:*:*:*
cpe:2.3:h:rletech:fds-pc-dp:-:*:*:*:*:*:*:*
EPSS
Процентиль: 45%
0.00223
Низкий
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 6.1
github
больше 3 лет назад
An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.
EPSS
Процентиль: 45%
0.00223
Низкий
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79