PT-2024-14838 · Genie Company · Aladdin Connect

Deral Heiland · Published 2024-01-03 · Updated 2024-08-27 · CVE-2023-5880

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) (affected versions not specified)

Description The Genie Company Aladdin Connect garage door opener is vulnerable to XSS via a broadcast SSID name containing malicious code with client-side JavaScript and/or HTML when placed into configuration mode. This allows an attacker to inject malicious code into the user's web browser through the "Garage Door Control Module Setup" page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-5880

Affected Products

Aladdin Connect

References · 9

• https://osv.dev/vulnerability/CVE-2023-5880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5880 · Security Note
• https://rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1742661176201294054 · Twitter Post
• https://t.me/cvenotify/67095 · Telegram Post
• https://twitter.com/CVEnew/status/1742627828896837776 · Twitter Post
• https://t.me/cvenotify/92338 · Telegram Post
• https://t.me/cibsecurity/74342 · Telegram Post
• https://t.me/cvenotify/66145 · Telegram Post