PT-2020-16485 · Kaa · Kaa Iot Platform

Published 2020-11-17 · Updated 2020-12-09 · CVE-2020-26701

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kaa IoT Platform version 1.2.0

Description The issue allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter in the Dashboards section. This enables attackers to execute arbitrary code on the client-side, potentially leading to unauthorized access or data theft.

Recommendations For Kaa IoT Platform version 1.2.0, consider restricting access to the Dashboards section until a patch is available. As a temporary workaround, avoid using the Description parameter in the affected section to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26701

Affected Products

Kaa Iot Platform

References · 7

• 🔥 http://packetstormsecurity.com/files/160082/Kaa-IoT-Platform-1.2.0-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26701 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26701 · Vendor Advisory
• https://t.me/cibsecurity/17330 · Telegram Post
• https://t.me/cibsecurity/17338 · Telegram Post
• https://t.me/cvenotify/6254 · Telegram Post
• https://t.me/cibsecurity/16458 · Telegram Post