PT-2015-6670 · Airties · Airties Rt-210

Publicado 2015-06-19 · Atualizado 2016-12-07 · CVE-2015-4679

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Airties RT-210 (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the ddns domainame and ddns account parameters to ddns.stm are vulnerable.

Recommendations For Airties RT-210, as a temporary workaround, consider restricting access to the ddns.stm endpoint until a patch is available. Avoid using the ddns domainame and ddns account parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-4679

Produtos afetados

Airties Rt-210

Referências · 3

• 🔥 http://packetstormsecurity.com/files/132178/Airties-RT210-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-4679 · Nota de Segurança
• http://securityfocus.com/bid/75342 · Nota