CVE-2024-0554
Published Jan 16, 2024
Last updated 10 months ago
Overview
- Description
- A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could store a malicious javascript payload in the device model parameter via '/setup/diags_ir_learn.asp', allowing the attacker to retrieve the session details of another user.
- Source
- cve-coordination@incibe.es
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.4
- Impact score
- 2.7
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:xantech:wic1200_firmware:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27A5FA72-8BA5-4BE7-89D2-8D85C1554A8A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:xantech:wic1200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "04CACDA7-1954-4FDE-998A-E5675B65787F"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]