CVE-2018-19525

MEDIUM

Systrome ISG-600C,ISG-600H,ISG-800W 1.1-R2.1 - CSRF/XSS

Title source: llm
STIX 2.1

Description

An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validation.

References (4)

Core 4
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/151647/SYSTORME-ISG-Cross-Site-Request-Forgery.html
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Feb/31
Exploit, Third Party Advisory x_refsource_misc
https://s3curityb3ast.github.io/KSA-Dev-002.md

Scores

CVSS v3 6.1
EPSS 0.0091
EPSS Percentile 55.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-352 CWE-79
Status published
Products (3)
systrome/cumilon_isg-600c_firmware 1.1-r2.1
systrome/cumilon_isg-600h_firmware 1.1-r2.1
systrome/cumilon_isg-800w_firmware 1.1-r2.1
Published Mar 21, 2019
Tracked Since Feb 18, 2026