CVE-2023-2392lowCWE-79

CVE-2023-2392: low-severity vulnerability in Netgear SRX5308

Netgear SRX5308 Web Management Interface cross site scripting

Published · Updated

Follow this CVE+ Monitor SRX5308

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.4epss 0.6%
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ManualDate.minutes leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Affected products
Netgear · SRX5308
Related CVEs — Netgear SRX5308

In the same product, most dangerous first.

CVE-2023-2380MEDIUMNetgear SRX5308 denial of serviceEPSS 1.3%CVE-2023-2396MEDIUMNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.8%CVE-2023-2395MEDIUMNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.8%CVE-2023-2390LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2023-2389LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2023-2383LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%