PT-2021-11740 · Digisol · Digisol Dg-Hr3400

Sayli Ambure · Published 2021-01-06 · Updated 2021-01-09 · CVE-2020-35262

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Digisol DG-HR3400 (affected versions not specified)

Description: The issue is a Cross Site Scripting (XSS) vulnerability that can be exploited via the NTP server name in the Time and date module and the Keyword in the URL Filter. This allows for potential malicious script execution.

Recommendations: As a temporary workaround, consider restricting access to the Time and date module and the URL Filter to minimize the risk of exploitation. Avoid using the Keyword in the URL Filter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-35262

Affected Products

Digisol Dg-Hr3400

References · 6

• 🔥 https://github.com/the-girl-who-lived/CVE-2020-35262 · Exploit
• 🔥 https://youtu.be/E5wEzf-gkOE · Exploit
• http://digisol.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35262 · Security Note
• https://t.me/cvenotify/8377 · Telegram Post
• https://t.me/cibsecurity/21721 · Telegram Post