CVE-2023-4202

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2023/Aug/13
https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:advantech:eki-1524:-:*:*:*:*:*:*:*

cpe:2.3:o:advantech:eki-1524_firmware:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:h:advantech:eki-1522:-:*:*:*:*:*:*:*

cpe:2.3:o:advantech:eki-1522_firmware:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:h:advantech:eki-1521:-:*:*:*:*:*:*:*

cpe:2.3:o:advantech:eki-1521_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-08 11:15

Updated : 2023-08-14 19:15

NVD link : CVE-2023-4202

Mitre link : CVE-2023-4202

CVE.ORG link : CVE-2023-4202

JSON object : View

Products Affected

advantech

eki-1524
eki-1522
eki-1521_firmware
eki-1524_firmware
eki-1522_firmware
eki-1521

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-4202", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "office@cyberdanube.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2023-08-08T11:15:11.980", "references": [{"url": "http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html", "source": "office@cyberdanube.com"}, {"url": "http://seclists.org/fulldisclosure/2023/Aug/13", "source": "office@cyberdanube.com"}, {"url": "https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/", "tags": ["Exploit", "Third Party Advisory"], "source": "office@cyberdanube.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "office@cyberdanube.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.\n\n\n"}, {"lang": "es", "value": "Los dispositivos Advantech EKI-1524, EKI-1522, EKI-1521 hasta la versi\u00f3n 1.21 est\u00e1n afectados por una vulnerabilidad de secuencias de comandos cruzadas almacenadas, que puede ser activada por usuarios autenticados en el campo del nombre del dispositivo de la interfaz web.\n"}], "lastModified": "2023-08-14T19:15:14.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:eki-1524:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2539F0F2-3146-4722-BAF1-073BEBE0FDAC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:advantech:eki-1524_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F979623-F2E3-4C9E-AA1F-8F8859118398", "versionEndIncluding": "1.21"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:eki-1522:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4B99453E-E903-40D9-8417-33C38A414052"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:advantech:eki-1522_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A379029-41F7-4364-BDF5-7FB16CF80063", "versionEndIncluding": "1.21"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:eki-1521:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FC553347-9FAB-467F-8ED7-45878D9D9886"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:advantech:eki-1521_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63022BB6-061F-4869-AF9D-D422932612FB", "versionEndIncluding": "1.21"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "office@cyberdanube.com"}

5.4 /10