CVE-2013-5223D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
Bekannt ausgenutzt — D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
CISA hat am 25.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.04.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-5223
Beschreibung
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| dlink | dsl-2760u firmware | < 1.12 |
Referenzen und Patches
- 99611 vdb-entryBroken Link
- 99609 vdb-entryBroken Link
- dlink-cve20135223-xss(88723) vdb-entryThird Party AdvisoryVDB Entry
- dlink-cve20135223-multiple-xss(88724) vdb-entryThird Party AdvisoryVDB Entry
- 99605 vdb-entryBroken Link
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002 Vendor Advisory
- 99607 vdb-entryBroken Link
- 99608 vdb-entryBroken Link
- 99606 vdb-entryBroken Link
- 99610 vdb-entryBroken Link
- 99604 vdb-entryBroken Link
- 99615 vdb-entryBroken Link
- 20131110 D-Link Router 2760N (DSL-2760U-BN) Multiple XSS mailing-listExploitMailing ListThird Party Advisory
- 99603 vdb-entryBroken Link
- 99612 vdb-entryBroken Link
- 99616 vdb-entryBroken Link
- http://packetstormsecurity.com/files/123976 ExploitThird Party AdvisoryVDB Entry
- 99613 vdb-entryBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5223 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:o:dlink:dsl-2760u_firmware:*:*:*:*:*:*:*:*< 1.12