PT-2019-5722 · Advantech · Advantech Spectre Rt Industrial Routers Ert351

Published 2019-04-25 · Updated 2021-03-23 · CVE-2019-18233

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech Spectre RT Industrial Routers ERT351 versions 5.1.3 and prior

Description The issue is related to insufficient protection of the web page structure, allowing for reflected XSS attacks. This can be exploited by a remote attacker using a specially crafted URL. The affected product does not neutralize special characters in the error response, enabling attackers to perform a reflected XSS attack.

Recommendations For versions 5.1.3 and prior, consider disabling the error response feature or restricting access to the web interface until a patch is available. As a temporary workaround, avoid using special characters in URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-00845

CVE-2019-18233

Affected Products

Advantech Spectre Rt Industrial Routers Ert351

References · 6

• https://ep.advantech-bb.cz/support/router-models/download/511/sa-2021-01-fw-5.1.3-and-older-en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18233 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18233 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00845 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-054-03 · Note
• https://t.me/cibsecurity/25056 · Telegram Post