6.1

CVE-2018-20326

Exploit
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var:subpage parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Chinamobile ≫ Gpn2.4p21-c-cn Firmware Versionw2001en-00
   Chinamobile ≫ Gpn2.4p21-c-cn Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.82% 0.908
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://packetstormsecurity.com/files/150918/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Scripting.html
Third Party Advisory
Exploit
VDB Entry
https://0dayfindings.home.blog/2018/12/26/plc-wireless-router-gpn2-4p21-c-cn-reflected-xss/
Third Party Advisory
Exploit
https://www.exploit-db.com/exploits/46081/
Third Party Advisory
Exploit
VDB Entry
https://youtu.be/TwNi05yfQks
Third Party Advisory
Exploit