PT-2021-6849 · Openwrt · Openwrt

Published 2021-12-27 · Updated 2023-05-24 · CVE-2021-45905

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenWrt version 21.02.1

Description The issue exists due to inadequate protection of the web page structure in the OpenWrt embedded operating system. This allows for a potential Cross-Site Scripting (XSS) attack via the Traffic Rules Name screen, which could enable a remote attacker to impact the confidentiality and integrity of protected information.

Recommendations For OpenWrt version 21.02.1, update to a newer version that includes a fix for this issue to prevent potential XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-02323

CVE-2021-45905

Affected Products

Openwrt

References · 7

• 🔥 https://bugs.openwrt.org/index.php?do=details&task_id=4199 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45905 · Security Note
• https://bdu.fstec.ru/vul/2022-02323 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45905 · Vendor Advisory
• https://github.com/openwrt/openwrt/issues/9179 · Note
• https://t.me/cibsecurity/34697 · Telegram Post
• https://t.me/cvenotify/51054 · Telegram Post