CVE-2015-1028

EPSS 2.8%

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).

Affected products

n/a · n/a

public PoCs found — 6

cve_referencewww.exploit-db.com/exploits/35747unverified cve_referencewww.exploit-db.com/exploits/35750unverified cve_referencewww.exploit-db.com/exploits/35751unverified exploitdbwww.exploit-db.com/exploits/35751unverified exploitdbwww.exploit-db.com/exploits/35750unverified exploitdbwww.exploit-db.com/exploits/35747unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://www.exploit-db.com/exploits/35747 http://www.exploit-db.com/exploits/35750 http://www.exploit-db.com/exploits/35751 http://www.xlabs.com.br/blog/?p=339