PT-2015-6670 · Airties · Airties Rt-210

Published 2015-06-19 · Updated 2016-12-07 · CVE-2015-4679

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Airties RT-210 (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the ddns domainame and ddns account parameters to ddns.stm are vulnerable.

Recommendations For Airties RT-210, as a temporary workaround, consider restricting access to the ddns.stm endpoint until a patch is available. Avoid using the ddns domainame and ddns account parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-4679

Affected Products

Airties Rt-210

References · 3

• 🔥 http://packetstormsecurity.com/files/132178/Airties-RT210-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-4679 · Security Note
• http://securityfocus.com/bid/75342 · Note