PT-2024-13205 · Cobham · Cobham Sailor Vsat Ku

Published 2024-04-12 · Updated 2025-05-27 · CVE-2023-44856

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cobham SAILOR VSAT Ku version 164B019

Description A Cross Site Scripting (XSS) issue allows a remote attacker to execute arbitrary code via a crafted script to the rstat, sender, and recipients parameters of the sub 21D24 function in the acu web file. This enables the attacker to potentially manipulate the system.

Recommendations For Cobham SAILOR VSAT Ku version 164B019, as a temporary workaround, consider restricting access to the sub 21D24 function in the acu web file until a patch is available. Avoid using the rstat, sender, and recipients parameters in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-44856

Affected Products

Cobham Sailor Vsat Ku

References · 5

• 🔥 https://pine-amphibian-9b9.notion.site/ENG-SAILOR-Ku-Software-XSS-Statistics-report-e97364c9d09449cf8869417e7187e997 · Exploit
• https://osv.dev/vulnerability/CVE-2023-44856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44856 · Security Note
• https://t.me/cvenotify/123719 · Telegram Post
• https://t.me/cvenotify/76518 · Telegram Post