What is the CVSS score of CVE-2023-49225?

CVE-2023-49225 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2023-49225?

Yes, a patch is available for CVE-2023-49225. Update the affected software to the latest version immediately.

R750 Firmware CVE-2023-49225

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2023-12-07 vultures@jpcert.or.jp

XSS R750 Firmware R650 Firmware R730 Firmware T750 Firmware R510 Firmware E510 Firmware C110 Firmware R320 Firmware H510 Firmware H320 Firmware T305 Firmware M510 Firmware R720 Firmware R710 Firmware T710 Firmware T610 Firmware R610 Firmware T310D Firmware T310S Firmware T310N Firmware T310C Firmware T710S Firmware T610S Firmware R550 Firmware R850 Firmware T750Se Firmware R310 Firmware R760 Firmware R560 Firmware H550 Firmware H350 Firmware T350C Firmware T350D Firmware T350Se Firmware R350 Firmware Smartzone Firmware Zonedirector Firmware

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Dec 07, 2023 - 07:15 nvd

MEDIUM 6.1

DescriptionNVD

A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.

AnalysisAI

A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section. Affected products include: Ruckuswireless R750 Firmware, Ruckuswireless R650 Firmware, Ruckuswireless R730 Firmware, Ruckuswireless T750 Firmware, Ruckuswireless R510 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.