漏洞描述
A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting (XSS), enabling attackers to inject JavaScript code. The attack can be executed remotely by tricking victims into visiting a malicious website, potentially leading to session hijacking. This vulnerability is publicly disclosed and identified as CVE-2024-5420.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
cyberdanube.comhttps://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html↗seclists.orghttps://seclists.org/fulldisclosure/2024/Jun/4↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-5420↗seclists.orghttp://seclists.org/fulldisclosure/2024/Jun/4↗cyberdanube.comhttps://cyberdanube.com/en/en-multiple-vulnerabilities-in-oring-iap420/index.html↗