PT-2025-3005 · Nradio · Nradio N8-180 Nros

Edward Warren · Published 2025-02-03 · Updated 2025-02-03 · CVE-2024-53943

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NRadio N8-180 NROS version 1.9.2.n3.c5

Description An issue was discovered in NRadio devices, where the "/cgi-bin/luci/nradio/basic/radio" endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters. This allows an attacker to execute JavaScript within the context of the current user by injecting JavaScript into the SSID field. If an administrator logs into the device, the injected script runs in their browser, executing the malicious payload.

Recommendations For NRadio N8-180 NROS version 1.9.2.n3.c5, as a temporary workaround, consider disabling access to the "/cgi-bin/luci/nradio/basic/radio" endpoint until a patch is available. Restrict the use of the 2.4 GHz and 5 GHz name parameters in this endpoint to minimize the risk of exploitation. Avoid using the SSID field in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53943

Affected Products

Nradio N8-180 Nros

References · 6

• 🔥 https://github.com/actuator/cve/blob/main/NRADIO/N8-180Firmware-Version-NROS-1.9.2.n3.c5-XSS.gif · Exploit
• 🔥 https://github.com/actuator/cve/blob/main/NRADIO/CVE-2024-53943.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53943 · Security Note
• https://twitter.com/CVEnew/status/1886479337362506215 · Twitter Post
• https://nradiowifi.net/article/9.html · Note
• https://t.me/cvedetector/17086 · Telegram Post