CVE-2023-24496mediumCWE-80

CVE-2023-24496: medium-severity vulnerability in MilesightVPN

Published · Updated

Follow this CVE+ Monitor MilesightVPN

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 0.6%
Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Milesight · MilesightVPN
Related CVEs — MilesightVPN

In the same product, most dangerous first.

CVE-2023-22371HIGHCVE-2023-22371EPSS 3.4%CVE-2023-23907HIGHCVE-2023-23907EPSS 1.2%CVE-2023-22319HIGHCVE-2023-22319EPSS 0.9%CVE-2023-22844HIGHCVE-2023-22844EPSS 0.8%CVE-2023-24497MEDIUMCVE-2023-24497EPSS 0.6%