PT-2015-7101 · Kasda+1 · Kasda Kw58293+1

Eskie Cirrus James Maquilang · Publicado 2015-09-21 · Atualizado 2015-09-22 · CVE-2015-5992

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PLDT SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN Kasda KW58293 devices

Description A cross-site scripting (XSS) issue exists in the form2WlanSetup.cgi file, allowing remote attackers to inject arbitrary web script or HTML via the ssid parameter. This could potentially lead to unauthorized actions on the device.

Recommendations For PLDT SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN, avoid using the ssid parameter in the form2WlanSetup.cgi file until the issue is resolved. For Kasda KW58293 devices, restrict access to the form2WlanSetup.cgi file to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-5992

Produtos afetados

Kasda Kw58293

Pldt Speedsurf 504An

Referências · 2

• http://kb.cert.org/vuls/id/525276 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5992 · Nota de Segurança