Description
Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization.
References (3)
Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180410-01_Teltonika_Cross_Site_Scripting
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/Oct/29
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/149781/Teltonika-RUT9XX-Reflected-Cross-Site-Scripting.html
Scores
CVSS v3
6.1
EPSS
0.0036
EPSS Percentile
57.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (3)
teltonika/rut900_firmware
< 00.05.01.1
teltonika/rut950_firmware
< 00.05.01.1
teltonika/rut955_firmware
< 00.05.01.1
Published
Oct 15, 2018
Tracked Since
Feb 18, 2026