CVE-2024-0554 — MEDIUM (5.5)

Vulnerability Description

A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could store a malicious javascript payload in the device model parameter via '/setup/diags_ir_learn.asp', allowing the attacker to retrieve the session details of another user.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Xantech	Wic1200 Firmware	1.1
Xantech	Wic1200	-

Related Weaknesses (CWE)

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fullThird Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fullThird Party Advisory

FAQ

What is CVE-2024-0554?

CVE-2024-0554 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could store a malicious javascript payload in the device model parameter via '/setup/...

How severe is CVE-2024-0554?

CVE-2024-0554 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-0554?

Check the references section above for vendor advisories and patch information. Affected products include: Xantech Wic1200 Firmware, Xantech Wic1200.