PT-2025-5686 · Sensaphone · Sensaphone Web600

Published 2025-02-05 · Updated 2025-07-21 · CVE-2024-55040

Positive Technologies · (AI Summary)

CVSS v3.1

6.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions:

Sensaphone Web600 (affected versions not specified)

Description:

The issue concerns stored cross-site scripting (XSS) in the system's Setup, Profile, and Zone options. This means that an attacker could potentially inject malicious code into these areas, which would then be executed by the system.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-55040

Affected Products

Sensaphone Web600

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-55040 · Security Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-55040 · Note
• https://twitter.com/tbutler0x90/status/1886944537269973222 · Twitter Post
• https://t.me/cvenotify/129703 · Telegram Post
• https://sensaphone.com/products/sensaphone-web600-monitoring-system · Note
• https://github.com/tcbutler320/Sensaphone-WEB600-XSS · Note
• https://twitter.com/CVEnew/status/1947322217806893427 · Twitter Post