1. EXECUTIVE SUMMARY
- CVSS v3 5.4
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Advantech
- Equipment: EKI-1524-CE, EKI-1522-CE, EKI-1521-CE
- Vulnerabilities: Cross-Site Scripting
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to execute code in the context of the session.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Advantech serial device servers are affected:
- EKI-1524-CE series: versions 1.24 and prior
- EKI-1522-CE series: versions 1.24 and prior
- EKI-1521-CE series: versions 1.24 and prior
3.2 Vulnerability Overview
3.2.1 Cross-Site Scripting CWE-79
Advantech EKI-1524, EKI-1522, EKI-1521 devices through version 1.21 are affected by a stored cross-site scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.
CVE-2023-4202 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
3.2.2 Cross-Site Scripting CWE-79
Advantech EKI-1524, EKI-1522, EKI-1521 devices through version 1.24 are affected by a stored cross-site scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface.
CVE-2023-4203 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (This article has been indexed from All CISA Advisories