PT-2018-17993 · Rle · Rle Wi-Mgr/Fds-Wi

Capitan Alfalo · Published 2018-02-21 · Updated 2018-03-21 · CVE-2018-7277

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RLE Wi-MGR/FDS-Wi version 6.2

Description An issue exists in the web server of the device, where persistent XSS allows remote attackers to inject malicious JavaScript code. This is achieved through the device's BACnet implementation and is similar to a Cross Protocol Injection with SNMP.

Recommendations For RLE Wi-MGR/FDS-Wi version 6.2, consider disabling the web server or restricting access to it until a patch is available to prevent exploitation of the persistent XSS issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-7277

Affected Products

Rle Wi-Mgr/Fds-Wi

References · 3

• 🔥 http://misteralfa-hack.blogspot.com/2018/02/bacnet-entrando-en-materia.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-7277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7277 · Security Note