4.8

CVE-2023-34412

Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an
authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Helmholz ≫ Rex 250 Firmware Version < 7.3.2
   Helmholz ≫ Rex 250 Version -
Helmholz ≫ Rex 200 Firmware Version < 7.3.2
   Helmholz ≫ Rex 200 Version -
Redlion ≫ Mbnet.Rokey Rkh 210 Firmware Version < 7.3.2
   Redlion ≫ Mbnet.Rokey Rkh 210 Version -
Redlion ≫ Mbnet.Rokey Rkh 216 Firmware Version < 7.3.2
   Redlion ≫ Mbnet.Rokey Rkh 216 Version -
Redlion ≫ Mbnet.Rokey Rkh 235 Firmware Version < 7.3.2
   Redlion ≫ Mbnet.Rokey Rkh 235 Version -
Redlion ≫ Mbnet.Rokey Rkh 259 Firmware Version < 7.3.2
   Redlion ≫ Mbnet.Rokey Rkh 259 Version -
Redlion ≫ Mbnet Mdh 811 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 811 Version -
Redlion ≫ Mbnet Mdh 850 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 850 Version -
Redlion ≫ Mbnet Mdh 871 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 871 Version -
Redlion ≫ Mbnet Mdh 831 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 831 Version -
Redlion ≫ Mbnet Mdh 855 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 855 Version -
Redlion ≫ Mbnet Mdh 876 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 876 Version -
Redlion ≫ Mbnet Mdh 858 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 858 Version -
Redlion ≫ Mbnet Mdh 816 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 816 Version -
Redlion ≫ Mbnet Mdh 841 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 841 Version -
Redlion ≫ Mbnet Mdh 859 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 859 Version -
Redlion ≫ Mbnet Mdh 835 Firmware Version < 7.3.2
   Redlion ≫ Mbnet Mdh 835 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.358
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
info@cert.vde.com 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://cert.vde.com/en/advisories/VDE-2023-012/
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-029/
Third Party Advisory