CVE-2021-39278: moxa oncell_g3470a-lte-eu_firmware Cross-site Scripting

Vulnerability summary

CVE-2021-39278 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in moxa oncell_g3470a-lte-eu_firmware. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-09-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.