CVE-2023-22921

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
7.5HIGH
EPSS
0.4%
top 40.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Zyxel Nbg-418n V2 FirmwareZyxel Nbg-418n Firmware
Timeline
PublishedMay 1

Description

A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to store malicious scripts using a web management interface parameter, resulting in denial-of-service (DoS) conditions on an affected device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:HExploitability: 1.7 | Impact: 5.3

Affected Packages2 packages

▶CVEListV5zyxel/nbg-418n_v2_firmware< V1.00(AARP.14)C0
▶NVDzyxel/nbg-418n_firmware1.00\(aarp.13\)c0

Patches

Patch: www.zyxel.com ↗Patch: www.zyxel.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2023-22921: A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1↗2023-05-01
▶
GHSA
GHSA-8rhh-pq82-8f6m: A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1↗2023-05-01
▶
CVE-2023-22921 (HIGH CVSS 7.5) | A cross-site scripting (XSS) vulner | cvebase.io