PT-2019-5722 · Advantech · Advantech Spectre Rt Industrial Routers Ert351

Publicado 2019-04-25 · Atualizado 2021-03-23 · CVE-2019-18233

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech Spectre RT Industrial Routers ERT351 versions 5.1.3 and prior

Description The issue is related to insufficient protection of the web page structure, allowing for reflected XSS attacks. This can be exploited by a remote attacker using a specially crafted URL. The affected product does not neutralize special characters in the error response, enabling attackers to perform a reflected XSS attack.

Recommendations For versions 5.1.3 and prior, consider disabling the error response feature or restricting access to the web interface until a patch is available. As a temporary workaround, avoid using special characters in URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2021-00845

CVE-2019-18233

Produtos afetados

Advantech Spectre Rt Industrial Routers Ert351

Referências · 6

• https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf · Aviso do Fabricante
• https://us-cert.cisa.gov/ics/advisories/icsa-21-054-03 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-18233 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18233 · Aviso do Fabricante
• https://t.me/cibsecurity/25056 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2021-00845 · Nota de Segurança