CVE-2021-38488CWE-79

Delta Electronics DIALink

Medium · published November 3, 2021

CVSS v3.1

5.5

EPSS

12%

Percentile

96.2

In the wild

Unconfirmed

What it is

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute code.

The record

Technical detail

CVSS v3.1: 5.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.12337 · 96.2th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2021-11-03T19:05Z

EPSS history

Timeline

03 NOV 19:05Z
Delta Electronics DIALink
cvelistv5