CVE-2023-51726CWE-79

Stored Cross Site Scripting Vulnerability in Skyworth Router

Medium · published January 17, 2024

CVSS v3.1
6.9
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the SMTP Server Name parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system.

Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-01-17T06:59Z
EPSS history
Timeline
  • 17 JAN 06:59Z
    Stored Cross Site Scripting Vulnerability in Skyworth Router
    cvelistv5