CVE-2018-25038: low-severity vulnerability in Thomson TCW710
Thomson TCW710 RgDhcp Persistent cross site scriting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.5epss 0.6%
A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected products
Thomson · TCW710Related CVEs — Thomson TCW710
In the same product, most dangerous first.
CVE-2018-25034LOWThomson TCW710 wlanPrimaryNetwork Persistent cross site scriptingEPSS 0.7%CVE-2018-25037LOWThomson TCW710 RgDdns Persistent cross site scritingEPSS 0.6%CVE-2018-25036LOWThomson TCW710 RgTime Persistent cross site scritingEPSS 0.6%CVE-2018-25035LOWThomson TCW710 RGFirewallEL Persistent cross site scritingEPSS 0.6%CVE-2018-25039LOWThomson TCW710 RgUrlBlock.asp Persistent cross site scritingEPSS 0.5%