PT-2018-14045 · Teltonika · Teltonika Rut9Xx

David Gnedt · Published 2018-10-15 · Updated 2018-11-30 · CVE-2018-17533

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Teltonika RUT9XX routers with firmware prior to 00.05.01.1

Description The issue is related to cross-site scripting due to insufficient user input sanitization in the hotspotlogin.cgi file.

Recommendations For firmware versions prior to 00.05.01.1, update the firmware to version 00.05.01.1 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-17533

Affected Products

Teltonika Rut9Xx

References · 5

• 🔥 https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180410-01_Teltonika_Cross_Site_Scripting · Exploit
• 🔥 http://packetstormsecurity.com/files/149781/Teltonika-RUT9XX-Reflected-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Oct/29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17533 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17533 · Vendor Advisory