Stored Cross-Site Scripting in Web Interface
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.78a, 2.00d, 1.72e
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The affected software is the web-based management interface of the device, which fails to properly encode certain stored values before displaying them. An attacker who can plant malicious content into those stored values could run scripts in the browser of a user who views the affected page, potentially compromising that user's session or actions in the interface.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
fixed in 1.78a
- WolfVision Cynap Pure (Next Gen), Cynap Bridge
fixed in 2.00d
- WolfVision Cynap Videobar
fixed in 1.72e
- WolfVision Cynap, Cynap Core, Cynap Pure SDM
0