Login
Request a Demo
Research Center
CVE-2022-21146 Research Center

CVE-2022-21146

Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts to review history.

  • 6.1 high severity

  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

  • 10/03/2022

Operating Systems 1

Ip

Ipdio Firmware

by Ipcomm

1 Version

3 years ago

Vulnerability Categories 1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

xTags 4

#easy_to_exploit
#known_vulnerability
#user_interaction_required_for_exploiting
#new_vulnerability_published

Advisory Links 1

https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01
http://www.vicarius.io is owned and operated by Vicarius Ltd. (the “Company”). All information contained on the Website is purely for informational, and educational purposes and should be independently verified and confirmed. Vicarius does not accept any liability for any loss or damage whatsoever caused in reliance upon such information or services. No statements or information presented in any form by Vicarius is intended as fact, and you agree that you will not consider the statements or information presented on the Website as fact or as a guarantee of performance.

Related CVEs

Security Research Topics

By David Parkinson Frost
Jul 19, 2024

Infosec News - Snowblind, BlackSuit, MOVEit, P2PInfect

By David Parkinson Frost
Jun 18, 2024

Infosec News - Stack Overflow, ShinyHunters, LightSpy, OpenAI

By Vicarius Studios .
Jun 18, 2024

Vicarius Studios Presents: These CVEs Were Made for Hackin

By
May 16, 2024

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

A zero-day vulnerability (CVE-2021–44228), known as Log4j or Log4Shell, is vigorously being targeted in the wild. The vulnerability allows an attacker to enter a carefully crafted string of characters into a web form to download malicious code. The result of the exploitation can allow for complete control of the infected system. Jeff Williams, Contrast Security, explains why cyber-threats nowadays are more threatening than they were in the past. He says the nature of cybersecurity threats is different from the challenges we faced in the Past.
By
May 16, 2024

CVE-2022-42856: Adjoining Splittail Vulnerability Report

Apple have reported a vulnerability in WebKit that allows for arbitrary code execution on a client. Exploitation is through maliciously crafted web content. This has been reported as suffering active exploitation against versions of iOS prior to 15.1.
last_chanse_04.png

Start Closing Security Gaps

  • Risk reduction from Day 1
  • Fast set-up and deployment
  • Unified platform
  • Full-featured 14-day trial
Request a Demo