Conceptronic C54APM CVE-2014-1407 Multiple Cross Site Scripting Vulnerabilities
BID:64793
Info
Conceptronic C54APM CVE-2014-1407 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 64793 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-1407 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2014 12:00AM |
| Updated: | Jan 09 2014 12:00AM |
| Credit: | Antonio Vázquez Blanco |
| Vulnerable: |
Conceptronic C54APM 2.0 Firmware 1.26 |
| Not Vulnerable: | |
Discussion
Conceptronic C54APM CVE-2014-1407 Multiple Cross Site Scripting Vulnerabilities
Conceptronic C54APM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Conceptronic C54APM 2.0 running firmware 1.26 is vulnerable; other versions may be affected.
Conceptronic C54APM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Conceptronic C54APM 2.0 running firmware 1.26 is vulnerable; other versions may be affected.
Exploit / POC
Conceptronic C54APM CVE-2014-1407 Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user into following a malicious URI.
Attackers can exploit these issues by enticing an unsuspecting user into following a malicious URI.
References
Conceptronic C54APM CVE-2014-1407 Multiple Cross Site Scripting Vulnerabilities
References:
References:
- Advisory C54APM Multiple (antoniovazquezblanco)
- C54APM Homepage (conceptronic)