CVE-2024-5420

published 2024-06-04

CVE-2024-5420: Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows…

Priority P3 55 high 8.3 CVSS 4.0

AV N AC L AT N PR N UI A VC H VI L VA H SC N SI N SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS)..This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
seh_computertechnik	inu-100	<= 20.1.22	—
seh_computertechnik	utnserver_pro	<= 20.1.22	—
seh_computertechnik	utnserver_promax	<= 20.1.22	—

Detection & IOCs extracted from sources · hover to see the quote

url POST /device/description_en.html HTTP/1.1↗

path /device/description_en.html↗

command action=set&sys_name=%E2%80%9C%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sys_descr=&sys_contact=↗

other html:"utnserver Control Center"↗

• → Detect exploitation attempt by matching POST body to the vulnerable endpoint with XSS payload in sys_name parameter ↗
• → Use Shodan query html:"utnserver Control Center" to identify exposed vulnerable devices on the internet ↗
• → The vulnerability is in the device description parameter (sys_name) of the web interface; monitor POST requests to /device/description_en.html with action=set for script injection patterns ↗

• · Exploitation requires authentication (PR:L); the attacker must be an authenticated user to POST to the device description endpoint ↗
• · Affected versions are 20.1.22 and below; devices running later firmware versions may not be vulnerable ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79