PT-2022-24581 · Fiberhome · Fiberhome An5506-02-B

Published 2022-09-15 · Updated 2022-09-19 · CVE-2022-38814

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FiberHome AN5506-02-B version vRP2521

Description A stored cross-site scripting (XSS) issue in the auth settings component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg loid text field. This enables attackers to potentially manipulate the web application's behavior.

Recommendations For FiberHome AN5506-02-B version vRP2521, consider disabling the auth settings component until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the sncfg loid text field to minimize the risk of arbitrary web script execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38814

Affected Products

Fiberhome An5506-02-B

References · 5

• 🔥 https://packetstormsecurity.com/files/168065/Fiberhome-AN5506-02-B-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-38814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38814 · Security Note
• https://t.me/cvenotify/36256 · Telegram Post
• https://t.me/cibsecurity/49852 · Telegram Post