CVE-2018-25039
LOWThomson TCW710 ST5D.10.05 - Stored Cross-Site Scripting via BasicParentalNewKeyword Parameter
Title source: llmDescription
A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://alquimistadesistemas.com/auditando-router-thomson-tcw710
Permissions Required, Third Party Advisory x_refsource_misc
https://vuldb.com/?id.126700
Scores
CVSS v3
3.5
EPSS
0.0050
EPSS Percentile
38.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-80
CWE-79
Status
published
Products (1)
technicolor/thomson_tcw710_firmware
st5d.10.05
Published
Jun 12, 2022
Tracked Since
Feb 18, 2026