PT-2021-7935 · Openwrt · Openwrt

Haya Shulman + 1 · Published 2021-08-02 · Updated 2023-05-24 · CVE-2021-32019

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 19.07.8

Description The issue is related to missing input validation of host names displayed in OpenWrt, which allows for XSS attacks on the Connection Status page of the luci web-interface. This can be exploited to gain full control over the affected system via ICMP. The vulnerability is associated with a lack of protection measures for the web page structure, enabling a remote attacker to conduct an inter-site scripting attack.

Recommendations For OpenWrt versions prior to 19.07.8, update to version 19.07.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Connection Status page of the luci web-interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05699

CVE-2021-32019

Affected Products

Openwrt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-32019 · Security Note
• https://bdu.fstec.ru/vul/2023-05699 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32019 · Vendor Advisory
• https://t.me/cvenotify/18539 · Telegram Post
• https://t.me/cibsecurity/26704 · Telegram Post
• https://openwrt.org/advisory/2021-08-01-1 · Note
• https://t.me/cvenotify/19116 · Telegram Post
• https://t.me/cvenotify/51051 · Telegram Post