CVE-2024-28092

UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Time Server 1, Time Server 2, Time Server 3, Target, Add Keyword, Add Domain, and Add Allowed Domain.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092
https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092

Configurations

No configuration.

History

21 Nov 2024, 09:05

Type	Values Removed	Values Added
References	~~() https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092 -~~	() https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092 -

31 Oct 2024, 15:35

Type	Values Removed	Values Added
Summary		(es) El software UBEE DDW365 XCNDDW365 8.14.3105 en el hardware 3.13.1 permite a un atacante remoto que se encuentre cerca de una red Wi-Fi realizar ataques XSS almacenados a través de RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp o RgParentalBasic.asp. Los campos afectados son Nombre del servidor SMTP, Nombre de usuario SMTP, Nombre del host, Servidor de hora 1, Servidor de hora 2, Servidor de hora 3, Destino, Agregar palabra clave, Agregar dominio y Agregar dominio permitido.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
CWE		CWE-79

20 Mar 2024, 13:00

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-19 21:15

Updated : 2024-11-21 09:05

NVD link : CVE-2024-28092

Mitre link : CVE-2024-28092

CVE.ORG link : CVE-2024-28092

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

7.2 /10