CVE-2021-38702

MEDIUMNuclei

cyberoamworks netgenie_c0101b1-20141120-ng11vo_firmware Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-38702 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

netgenie_c0101b1-20141120-ng11vo_firmware

Browse cyberoamworks / netgenie_c0101b1-20141120-ng11vo_firmware
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMCyberoam NetGenie Cross-Site ScriptingCVSS 6.1

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or firmware updates provided by the vendor to mitigate this vulnerability.

WeaknessesCWE-79
Authorsgeeknik
Template tagscve2021cvecyberoamnetgeniexssrouterseclistspacketstormcyberoamworksvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:cyberoamworks:netgenie_c0101b1-20141120-ng11vo_firmware:*:*:*:*:*:*:*:*
https://seclists.org/fulldisclosure/2021/Aug/20 https://nvd.nist.gov/vuln/detail/CVE-2021-38702 http://www.cyberoamworks.com/NetGenie-Home.asp http://packetstormsecurity.com/files/163859/Cyberoam-NetGenie-Cross-Site-Scripting.html https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

5