CVE-2024-5410

moderate-risk

Published 2024-05-28

Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below.

Do I need to act?

1.9% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Iap-420 Firmware

Affected Vendors

Oringnet

References (4)

Exploit http://seclists.org/fulldisclosure/2024/May/36

Exploit https://cyberdanube.com/en/en-multiple-vulnerabilities-in-oring-iap420/

Exploit http://seclists.org/fulldisclosure/2024/May/36

Exploit https://cyberdanube.com/en/en-multiple-vulnerabilities-in-oring-iap420/

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 5/34 · Minimal

Exposure 5/34 · Minimal