Search/CVE-2020-28968
● CVE — Medium

CVE-2020-28968

VendordraytekProductvigorap 910c firmware, vigorap 1000c firmware, vigorap 700 firmware, vigorap 710 firmware, vigorap 800 firmware, vigorap 802 firmware, vigorap 810 firmware, vigorap 900 firmware, vigorap 902 firmware, vigorap 903 firmware, vigorap 912c firmware, vigorap 918r firmware, vigorap 920r firmwareDiscoveredOct 22, 2021UpdatedNov 21, 2024

Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.

View graph Watch Export
CVSS v3.1
5.4 MEDIUM
EPSS
0.57%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionREQUIRED
ScopeCHANGED
ConfidentialityLOW
IntegrityLOW
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Connections
14 relationships
Timeline
disclosure → media coverage
Oct 22, 2021
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024