CVE-2021-37208CWE-79

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803…

Critical · published March 8, 2022

CVSS v3.1
9.6
EPSS
1%
Percentile
44.3
In the wild
Unconfirmed
What it is

🚨 A critical vulnerability in RUGGEDCOM devices could expose sensitive information with just a few crafty keystrokes! 🔥 Think of it like leaving the blueprint of your secret base out in the open. Any villain with a privileged position could just stroll in and snag that blueprint without triggering any alarms! An attacker could exploit this flaw to execute cross-site scripting attacks, potentially stealing sensitive data stored on the server. This could lead to unauthorized access to confidential information, putting your entire network at risk. The consequences could be absolutely devastating!

Put simply

Think of it like leaving the blueprint of your secret base out in the open. Any villain with a privileged position could just stroll in and snag that blueprint without triggering any alarms! The vulnerability arises from improper neutralization of special characters on the web server configuration page, allowing attackers to inject malicious scripts if they already have privileged access.

What to do

An attacker could exploit this flaw to execute cross-site scripting attacks, potentially stealing sensitive data stored on the server. This could lead to unauthorized access to confidential information, putting your entire network at risk. The consequences could be absolutely devastating! To safeguard your systems, immediately review and patch your RUGGEDCOM devices to the latest firmware version. Additionally, ensure that proper input validation measures are implemented to neutralize special characters, preventing potential XSS attacks. You've got this! By following these steps, you'll secure your systems and keep those blueprints safe! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H/E:P/RL:T/RC:C
CVSS v4.0
Not supplied
EPSS
0.00535 · 44.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-08T11:31Z
EPSS history
Timeline
  • 08 MAR 11:31Z
    A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803…
    cvelistv5