CVE-2018-0679

moderate-risk

Published 2018-11-15

Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.

Do I need to act?

0.24% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / LOW complexity

Affected Products (10)

Fxc5210 Firmware

Fxc5218 Firmware

Fxc5224 Firmware

Fxc5426F Firmware

Fxc5428 Firmware

Fxc5210Pe Firmware

Fxc5218Pe Firmware

Fxc5224Pe Firmware

Ae1021 Firmware

Ae1021Pe Firmware

Affected Vendors

Fxc

References (4)

Third Party Advisory http://jvn.jp/en/jp/JVN68528150/index.html

Mitigation https://www.fxc.jp/news/20171228.html

Third Party Advisory http://jvn.jp/en/jp/JVN68528150/index.html

Mitigation https://www.fxc.jp/news/20171228.html

/ 100

moderate-risk

Severity 19/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate