CVE-2019-17523

MEDIUM

Technicolor TC7300.b0_firmware - Stored Cross-Site Scripting via FTPDiag.asp FileName Parameter

Title source: llm

Description

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp.

References (2)

Core 2

Core References

Product x_refsource_misc

https://www.technicolor.com/news

Exploit, Third Party Advisory x_refsource_misc

https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17524/README.md

View Exploit ZIP pw:eip

Scores

CVSS v3 5.4

EPSS 0.0063

EPSS Percentile 45.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

technicolor/tc7300.b0_firmware stfa.51.20

Published Nov 13, 2019

Tracked Since Feb 18, 2026