CVE-2022-23397: cedargate ez-net

Record summary

CVE-2022-23397 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no clear steps of reproduction."

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Jul 22, 2025 · VulnCheck
Reported exploitation: Observed · VulnCheck

Available material

Nuclei templates: 1

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 23, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
ez-net_portal Browse cedargate / ez-net_portal	VulnCheck	Version data not supplied

Nuclei templates

ProjectDiscoveryMEDIUMCedar Gate EZ-NET <= 6.8.0 - Cross-Site ScriptingCVSS 6.1

Impact

Attackers can inject malicious JavaScript via reflected XSS in the Usertext parameter, potentially stealing administrator session cookies or performing administrative actions.

Remediation

Upgrade Cedar Gate EZ-NET Portal to a version newer than 6.8.0 that addresses the XSS vulnerability.

WeaknessesCWE-79

Authorssrilakivarma

Template tagscvecve2022cedareznetxssvkevvuln

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CPE: cpe:2.3:a:cedargate:ez-net_portal:6.5.5:*:*:*:*:*:*:*

Shodan: EZNET_

FOFA: EZNET_

https://ado.im/cedar-gate-ez-net https://nvd.nist.gov/vuln/detail/CVE-2022-23397

Source: ProjectDiscovery

References

ado.im

https://ado.im/cedar-gate-ez-net

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2022-23397