CVE-2024-23786

moderate-risk
Published 2024-02-14

Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product.

Do I need to act?

~
2.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.3/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Jh-Rvb1 Firmware
Jh-Rv11 Firmware

Affected Vendors

Sharp

References (6)

Vendor Advisory https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf
Vendor Advisory https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf
Third Party Advisory https://jvn.jp/en/vu/JVNVU94591337/
Vendor Advisory https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf
Vendor Advisory https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf
Third Party Advisory https://jvn.jp/en/vu/JVNVU94591337/
44
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 6/34 · Minimal
Exposure 7/34 · Low