PT-2014-4176 · Conceptronic · Conceptronic C54Apm

Published 2014-01-10 · Updated 2015-08-07 · CVE-2014-1407

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain actions. This can be achieved by exploiting the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or the wlan-url parameter to goform/formWlanSetup.

Recommendations For Conceptronic C54APM access point with runtime code 1.26, consider restricting access to the goform/formWlSiteSurvey and goform/formWlanSetup API endpoints until a patch is available. Avoid using the submit-url and wlan-url parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-1407

Affected Products

Conceptronic C54Apm

References · 4

• 🔥 http://antoniovazquezblanco.github.io/docs/advisories/Advisory_C54APM_Multiple.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1407 · Security Note
• http://osvdb.org/101919 · Note
• http://osvdb.org/101921 · Note