Ey As525F001 Firmware
CVE-2023-28650
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript (JS) payload in the target’s security context.
AnalysisAI
An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript (JS) payload in the target’s security context. Affected products include: Sauter-Controls Ey-As525F001 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Ey As525F001 Firmware
View allAn authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.
An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, des
An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unautho
A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today