CVE-2023-51724 Vulnerability Details

  /     /     /  

CVE-2023-51724 Metadata Quick Info

CVE Published: 17/01/2024 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: CERT-In | Vendor: Hathway | Product: Skyworth Router CM5100
Status : PUBLISHED

---

CVE-2023-51724 Description

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the URL parameter at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to the parameter at the web interface of the vulnerable targeted system. Successful exploitation of this vulnerability could allow the attacker to perform stored XSS attacks on the targeted system.

Metrics

CVSS Version: 3.1 | Base Score: 6.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* HIGH
    User Interaction (UI)* REQUIRED
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* HIGH
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: CWE-79 Improper Neutralization of Input During Web Page Generation ( Cross-site Scripting )
Source: Hathway

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-592
CAPEC Description: CAPEC-592 Stored XSS


Source: NVD (National Vulnerability Database).