PT-2024-22260 · Ubee · Ubee Ddw365

Edward Warren · Published 2024-03-19 · Updated 2024-10-31 · CVE-2024-28092

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions UBEE DDW365 XCNDDW365 version 8.14.3105 on hardware 3.13.1

Description The issue allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via several ASP pages, including RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Time Server 1, Time Server 2, Time Server 3, Target, Add Keyword, Add Domain, and Add Allowed Domain.

Recommendations For UBEE DDW365 XCNDDW365 version 8.14.3105 on hardware 3.13.1, consider disabling access to the vulnerable ASP pages, such as RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, and RgParentalBasic.asp, until a patch is available. Restrict input for the affected fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-28092

Affected Products

Ubee Ddw365

References · 4

• 🔥 https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28092 · Security Note
• https://twitter.com/CVEnew/status/1770196829075874212 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1770216404320387221 · Twitter Post