PT-2023-6361 · Connectize · Connectize Ac21000 G6

Published 2023-10-19 · Updated 2024-08-27 · CVE-2023-24050

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Connectize AC21000 G6 version 641.139.1.1256

Description The issue is related to a Cross Site Scripting (XSS) vulnerability that allows attackers to run arbitrary code via a crafted string when setting the Wi-Fi password in the admin panel. This can be exploited by a remote attacker to change the Wi-Fi password. The vulnerability is associated with the lack of protection of the web page structure.

Recommendations For Connectize AC21000 G6 version 641.139.1.1256, as a temporary workaround, consider restricting access to the admin panel until a patch is available. Avoid using the admin panel to set the Wi-Fi password until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07073

CVE-2023-24050

Affected Products

Connectize Ac21000 G6

References · 15

• https://bdu.fstec.ru/vul/2023-07073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24050 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24050 · Vendor Advisory
• https://t.me/cvenotify/62896 · Telegram Post
• https://t.me/cvenotify/62924 · Telegram Post
• https://t.me/cvenotify/62216 · Telegram Post
• https://t.me/cvenotify/62215 · Telegram Post
• https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve · Note
• https://t.me/cvenotify/62971 · Telegram Post
• https://t.me/cvenotify/62925 · Telegram Post
• https://t.me/cvenotify/92382 · Telegram Post
• https://twitter.com/CVEnew/status/1731814834705232024 · Twitter Post
• https://t.me/cvenotify/62218 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1731851457610088674 · Twitter Post
• https://t.me/malwr/7668 · Telegram Post