Technicolor TC8715D 01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T User Defined Service managed_services_add.asp cross site scripting

Summaryinfo

A vulnerability classified as problematic has been found in Technicolor TC8715D 01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T. Impacted is an unknown function of the file managed_services_add.asp of the component User Defined Service. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2024-28091. The attack must be carried out from within the local network. There is no available exploit.

Detailsinfo

A vulnerability was found in Technicolor TC8715D 01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T and classified as problematic. This issue affects some unknown processing of the file managed_services_add.asp of the component User Defined Service. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via User Defined Service in managed_services_add.asp (the victim must click an X for a deletion).

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-28091 since 03/04/2024. The exploitation is known to be easy. Access to the local network is required for this attack to succeed. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

By approaching the search of inurl:managed_services_add.asp it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Technicolor

Name

• TC8715D

Version

• 01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion