Description (CNA)
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| D-Link / Nuclias Connect | affected 0 before 1.3.1.4 |
CWE
CWE-79
References
- https://www.vulncheck.com/advisories/dlink-nuclias-connect-stored-xss
- https://www.dlink.com/en/for-business/nuclias/nuclias-connect
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472
ADP enrichment
No English description supplied.
No references supplied.