PT-2014-8790 · Zte · Zte Zxdsl

Publicado 2014-11-20 · Atualizado 2018-10-09 · CVE-2014-9020

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZTE ZXDSL versions 831 and 831CII

Description A cross-site scripting (XSS) issue exists in the Quick Stats page, specifically in the psilan.cgi component, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the domainname parameter in a save action.

Recommendations For ZTE ZXDSL versions 831 and 831CII, consider restricting access to the psilan.cgi component as a temporary workaround until a patch is available. Avoid using the domainname parameter in the affected save action to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9020

Produtos afetados

Zte Zxdsl

Referências · 8

• 🔥 http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSRF.html · Exploit
• 🔥 http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98584 · Nota
• http://securityfocus.com/bid/70984 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9020 · Nota de Segurança
• http://securityfocus.com/archive/1/533930/100/0/threaded · Nota
• http://securityfocus.com/archive/1/533931/100/0/threaded · Nota
• http://securityfocus.com/bid/70985 · Nota