CVE-2024-55546

low-risk

Published 2024-12-10

Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below.

Do I need to act?

0.15% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Iap-420 Firmware

Affected Vendors

Oringnet

References (3)

Exploit https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities...

http://seclists.org/fulldisclosure/2024/Dec/3

Exploit https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities...

/ 100

low-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal