CVE-2018-0679

Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.
References
Link Resource
http://jvn.jp/en/jp/JVN68528150/index.html Third Party Advisory
https://www.fxc.jp/news/20171228.html Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:fxc:fxc5210_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5210:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:fxc:fxc5218_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5218:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:fxc:fxc5224_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5224:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:fxc:fxc5426f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5426f:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:fxc:fxc5428_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5428:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:fxc:fxc5210pe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5210pe:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:fxc:fxc5218pe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5218pe:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:fxc:fxc5224pe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:fxc5224pe:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:fxc:ae1021_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:ae1021:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:fxc:ae1021pe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:fxc:ae1021pe:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-11-15 15:29

Updated : 2024-02-28 16:48


NVD link : CVE-2018-0679

Mitre link : CVE-2018-0679

CVE.ORG link : CVE-2018-0679


JSON object : View

Products Affected

fxc

  • fxc5218_firmware
  • ae1021_firmware
  • ae1021pe
  • fxc5210pe_firmware
  • fxc5224pe_firmware
  • fxc5224pe
  • fxc5210
  • fxc5224_firmware
  • fxc5218pe
  • fxc5218pe_firmware
  • fxc5426f_firmware
  • fxc5218
  • fxc5426f
  • ae1021pe_firmware
  • fxc5210pe
  • ae1021
  • fxc5224
  • fxc5428
  • fxc5210_firmware
  • fxc5428_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')