Lweb 802
Monthly
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.