PT-2025-3420 · Prolink · Prolink 4G Lte Mobile Wi-Fi Dl-7203E

Published 2025-02-03 · Updated 2025-03-03 · CVE-2024-57237

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Prolink 4G LTE Mobile Wi-Fi DL-7203E version 4.0.0B05

Description The issue arises due to a Cross Site Scripting (XSS) vulnerability in the "/reqproc/proc get" endpoint. This occurs because the cmd parameter does not properly sanitize input, and the response is served with a Content-Type of text/html, allowing the browser to execute injected JavaScript code.

Recommendations For Prolink 4G LTE Mobile Wi-Fi DL-7203E version 4.0.0B05, as a temporary workaround, consider disabling access to the "/reqproc/proc get" endpoint until a patch is available. Additionally, restrict the use of the cmd parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-57237

Affected Products

Prolink 4G Lte Mobile Wi-Fi Dl-7203E

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-57237 · Security Note
• https://t.me/cvedetector/17119 · Telegram Post
• https://harryha.substack.com/p/4g-lte-mobile-wifi-dl7203e-xss-cve-2024-57237 · Note
• https://twitter.com/CVEnew/status/1886499095151612029 · Twitter Post
• https://prolink2u.com/products/dl-7203e-b · Note
• https://t.me/cvenotify/113195 · Telegram Post