PT-2025-5686 · Sensaphone · Sensaphone Web600

CVE-2024-55040 · Publicado 2025-02-05 · Atualizado 2025-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Sensaphone Web600 (affected versions not specified)

Description: The issue concerns stored cross-site scripting (XSS) in the system's Setup, Profile, and Zone options. This means that an attacker could potentially inject malicious code into these areas, which would then be executed by the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2024-55040

Produtos afetados

Sensaphone Web600

Referências · 8

• https://github.com/tcbutler320/Sensaphone-WEB600-XSS · Nota
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-55040 · Nota
• https://twitter.com/tbutler0x90/status/1886944537269973222 · Publicação no Twitter
• https://sensaphone.com/products/sensaphone-web600-monitoring-system · Nota
• https://osv.dev/vulnerability/CVE-2024-55040 · Aviso do Fabricante
• https://t.me/cvenotify/129703 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-55040 · Nota de Segurança
• https://twitter.com/CVEnew/status/1947322217806893427 · Publicação no Twitter