CVE-2023-4202

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2023/Aug/13
https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/	Exploit Third Party Advisory
http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2023/Aug/13
https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:advantech:eki-1524_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:advantech:eki-1524:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:advantech:eki-1522_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:advantech:eki-1522:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:advantech:eki-1521_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:advantech:eki-1521:-:*:*:*:*:*:*:*

History

13 Feb 2025, 17:17

Type	Values Removed	Values Added
Summary	(en) Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.	(en) Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.

Information

Published : 2023-08-08 11:15

Updated : 2025-02-13 17:17

NVD link : CVE-2023-4202

Mitre link : CVE-2023-4202

CVE.ORG link : CVE-2023-4202

JSON object : View

Products Affected

advantech

eki-1521_firmware
eki-1524
eki-1522_firmware
eki-1521
eki-1522
eki-1524_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-4202", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "office@cyberdanube.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2023-08-08T11:15:11.980", "references": [{"url": "http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html", "source": "office@cyberdanube.com"}, {"url": "http://seclists.org/fulldisclosure/2023/Aug/13", "source": "office@cyberdanube.com"}, {"url": "https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/", "tags": ["Exploit", "Third Party Advisory"], "source": "office@cyberdanube.com"}, {"url": "http://packetstormsecurity.com/files/174153/Advantech-EKI-1524-CE-EKI-1522-EKI-1521-Cross-Site-Scripting.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2023/Aug/13", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cyberdanube.com/en/en-st-polten-uas-multiple-vulnerabilities-in-advantech-eki-15xx-series/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "office@cyberdanube.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface."}, {"lang": "es", "value": "Los dispositivos Advantech EKI-1524, EKI-1522, EKI-1521 hasta la versi\u00f3n 1.21 est\u00e1n afectados por una vulnerabilidad de secuencias de comandos cruzadas almacenadas, que puede ser activada por usuarios autenticados en el campo del nombre del dispositivo de la interfaz web.\n"}], "lastModified": "2025-02-13T17:17:15.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:advantech:eki-1524_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F979623-F2E3-4C9E-AA1F-8F8859118398", "versionEndIncluding": "1.21"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:eki-1524:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2539F0F2-3146-4722-BAF1-073BEBE0FDAC"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:advantech:eki-1522_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A379029-41F7-4364-BDF5-7FB16CF80063", "versionEndIncluding": "1.21"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:eki-1522:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4B99453E-E903-40D9-8417-33C38A414052"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:advantech:eki-1521_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63022BB6-061F-4869-AF9D-D422932612FB", "versionEndIncluding": "1.21"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:eki-1521:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FC553347-9FAB-467F-8ED7-45878D9D9886"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "office@cyberdanube.com"}