PT-2014-4176 · Conceptronic · Conceptronic C54Apm

Publicado 2014-01-10 · Atualizado 2015-08-07 · CVE-2014-1407

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain actions. This can be achieved by exploiting the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or the wlan-url parameter to goform/formWlanSetup.

Recommendations For Conceptronic C54APM access point with runtime code 1.26, consider restricting access to the goform/formWlSiteSurvey and goform/formWlanSetup API endpoints until a patch is available. Avoid using the submit-url and wlan-url parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-1407

Produtos afetados

Conceptronic C54Apm

Referências · 4

• 🔥 http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf · Exploit
• http://osvdb.org/101919 · Nota
• http://osvdb.org/101921 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1407 · Nota de Segurança