CVE-2014-7277

ZyXEL SBG-3300-N Firmware < 1.00(aady.4)c0 - Cross-Site Scripting via Login Page Welcome Message

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified "welcome message" form data that is improperly handled during rendering of the loginMessage list item, a different vulnerability than CVE-2014-7278.

References (5)

Core 5

Core References

Exploit mailing-list x_refsource_bugtraq

http://archives.neohapsis.com/archives/bugtraq/2014-10/0024.html

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Oct/19

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/70232

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/128551/ZyXEL-SBG-3300-Security-Gateway-Cross-Site-Scripting.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/96891

Scores

EPSS 0.0034

EPSS Percentile 56.8%

Details

CWE

CWE-79

Status published

Products (2)

zyxel/sbg3300-n

zyxel/sbg3300-n_firmware < 1.00\(aady.4\)c0

Published Oct 04, 2014

Tracked Since Feb 18, 2026