VAR-201810-0456

Vulnerability from variot - Updated: 2023-12-18 12:43

Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization. TeltonikaRUT9XXrouters (also known as LuCI) is a router product from Teltonika, Lithuania.

  • Identifier : SBA-ADV-20180410-01
  • Type of Vulnerability : Cross Site Scripting
  • Software/Product Name : Teltonika RUT955
  • Vendor : Teltonika
  • Affected Versions : Firmware RUT9XX_R_00.05.00.5 and probably prior
  • Fixed in Version : RUT9XX_R_00.05.01.1
  • CVE ID : CVE-2018-17533
  • CVSSv3 Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
  • CVSSv3 Base Score : 8.2 (High)

Vendor Description

RUT955 is a highly reliable and secure LTE router with I/O, GNSS and RS232/RS485 for professional applications. Router delivers high performance, mission-critical cellular communication and GPS location capabilities.

Source: https://teltonika.lt/product/rut955/

Impact

By exploiting the documented vulnerabilities, an attacker can execute JavaScript code in a user's browser within the origin of the router. The attacker might take over existing or future administrative web management sessions and gain access to the device.

We recommend upgrading to version RUT9XX_R_00.05.01.1 or newer, which includes fixes for the vulnerabilities described in this advisory. The scripts are part of the coova-chilli captive portal. However, in firmware versions before RUT9XX_R_00.04.233 the vulnerabilities are exploitable regardless of the device configuration, even if no captive portal is configured.

More concretely, the following parameters are vulnerable:

  • /cgi-bin/hotspotlogin.cgi
  • If res=failed or res=notyet
    • challenge
    • uamip
    • uamport
    • userurl

The affected script outputs these input parameters in an HTML context without proper output encoding.

The vulnerabilities are located in hotspotlogin.cgi:

[...]
elseif result == 2 or result == 5 then
        replace_tags.formHeader = [[<form name="myForm" method="post" action="]] .. loginpath .. [[">
                        <INPUT TYPE="hidden" NAME="challenge" VALUE="]] .. challenge .. [[">
                        <INPUT TYPE="hidden" NAME="]] .. names["uamip"] .. [[" VALUE="]] .. uamip .. [[">
                        <INPUT TYPE="hidden" NAME="]] .. names["uamport"] .. [[" VALUE="]] .. uamport .. [[">
                        <INPUT TYPE="hidden" NAME="]] .. names["userurl"] .. [[" VALUE="]] ..userurldecode .. [[">
                        <INPUT TYPE="hidden" NAME="res" VALUE="]] .. res .. [[">]]
        replace_tags.formFooter = [[</form>]]
[...]

As the above code snippet shows, the parameter userurl contains user input and is output without performing any HTML escaping.

Proof-of-Concept

An attacker can exploit this vulnerability by manipulating the userurl query parameter:

http://<IP>/cgi-bin/hotspotlogin.cgi?res=failed&userurl="><script>alert(1)</script><span

An attacker can exploit the other parameters (e.g. challenge) via POST requests:

<form action="http://<IP>/cgi-bin/hotspotlogin.cgi" method="post" enctype="text/plain">
<input type="hidden" name="res" value="failed&challenge=&quot;><script>alert(1)</script><span&quot;">
<input type="submit" value="challenge">
</form>

Timeline

  • 2018-04-10 identification of vulnerability in version RUT9XX_R_00.04.161
  • 2018-04-16 re-test of version RUT9XX_R_00.04.172
  • 2018-04-16 initial vendor contact through public address
  • 2018-04-18 vendor response with security contact
  • 2018-04-19 disclosed vulnerability to vendor security contact
  • 2018-04-26 vendor released fix in version RUT9XX_R_00.04.233
  • 2018-07-09 notify vendor about incomplete fix in version RUT9XX_R_00.05.00.5
  • 2018-07-19 vendor released fix in version RUT9XX_R_00.05.01.1
  • 2018-07-25 re-test of version RUT9XX_R_00.05.01.2
  • 2018-09-25 request CVE from MITRE
  • 2018-09-26 MITRE assigned CVE-2018-17533
  • 2018-10-11 public disclosure

References

Credits

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201810-0456",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "rut900",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "teltonika",
        "version": "00.05.01.1"
      },
      {
        "model": "rut950",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "teltonika",
        "version": "00.05.01.1"
      },
      {
        "model": "rut955",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "teltonika",
        "version": "00.05.01.1"
      },
      {
        "model": "rut9xx",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "teltonika",
        "version": "00.05.01.1"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:teltonika:rut900_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "00.05.01.1",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:teltonika:rut900:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:teltonika:rut950_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "00.05.01.1",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:teltonika:rut950:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:teltonika:rut955_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "00.05.01.1",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:teltonika:rut955:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "David Gnedt",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "149781"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2018-17533",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-17533",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2019-18495",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-17533",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-17533",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2019-18495",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201810-711",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization. TeltonikaRUT9XXrouters (also known as LuCI) is a router product from Teltonika, Lithuania. \n\n* **Identifier**            : SBA-ADV-20180410-01\n* **Type of Vulnerability** : Cross Site Scripting\n* **Software/Product Name** : [Teltonika RUT955](https://teltonika.lt/product/rut955/)\n* **Vendor**                : [Teltonika](https://teltonika.lt/)\n* **Affected Versions**     : Firmware RUT9XX_R_00.05.00.5 and probably prior\n* **Fixed in Version**      : RUT9XX_R_00.05.01.1\n* **CVE ID**                : CVE-2018-17533\n* **CVSSv3 Vector**         : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\n* **CVSSv3 Base Score**     : 8.2 (High)\n\n## Vendor Description ##\n\n\u003e RUT955 is a highly reliable and secure LTE router with I/O, GNSS and\n\u003e RS232/RS485 for professional applications. Router delivers high\n\u003e performance, mission-critical cellular communication and GPS location\n\u003e capabilities. \n\nSource: \u003chttps://teltonika.lt/product/rut955/\u003e\n\n## Impact ##\n\nBy exploiting the documented vulnerabilities, an attacker can execute\nJavaScript code in a user\u0027s browser within the origin of the router. \nThe attacker might take over existing or future administrative web\nmanagement sessions and gain access to the device. \n\nWe recommend upgrading to version RUT9XX_R_00.05.01.1 or newer, which\nincludes fixes for the vulnerabilities described in this advisory. The scripts are part of\nthe coova-chilli captive portal. However, in firmware versions before\nRUT9XX_R_00.04.233 the vulnerabilities are exploitable regardless of\nthe device configuration, even if no captive portal is configured. \n\nMore concretely, the following parameters are vulnerable:\n\n* `/cgi-bin/hotspotlogin.cgi`\n  * *If* res=failed or res=notyet\n    * challenge\n    * uamip\n    * uamport\n    * userurl\n\nThe affected script outputs these input parameters in an HTML context\nwithout proper output encoding. \n\nThe vulnerabilities are located in `hotspotlogin.cgi`:\n\n```lua\n[...]\nelseif result == 2 or result == 5 then\n        replace_tags.formHeader = [[\u003cform name=\"myForm\" method=\"post\" action=\"]] .. loginpath .. [[\"\u003e\n                        \u003cINPUT TYPE=\"hidden\" NAME=\"challenge\" VALUE=\"]] .. challenge .. [[\"\u003e\n                        \u003cINPUT TYPE=\"hidden\" NAME=\"]] .. names[\"uamip\"] .. [[\" VALUE=\"]] .. uamip .. [[\"\u003e\n                        \u003cINPUT TYPE=\"hidden\" NAME=\"]] .. names[\"uamport\"] .. [[\" VALUE=\"]] .. uamport .. [[\"\u003e\n                        \u003cINPUT TYPE=\"hidden\" NAME=\"]] .. names[\"userurl\"] .. [[\" VALUE=\"]] ..userurldecode .. [[\"\u003e\n                        \u003cINPUT TYPE=\"hidden\" NAME=\"res\" VALUE=\"]] .. res .. [[\"\u003e]]\n        replace_tags.formFooter = [[\u003c/form\u003e]]\n[...]\n```\n\nAs the above code snippet shows, the parameter `userurl` contains user\ninput and is output without performing any HTML escaping. \n\n## Proof-of-Concept ##\n\nAn attacker can exploit this vulnerability by manipulating the `userurl`\nquery parameter:\n\n```text\nhttp://\u003cIP\u003e/cgi-bin/hotspotlogin.cgi?res=failed\u0026userurl=\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cspan\n```\n\nAn attacker can exploit the other parameters (e.g. challenge) via POST\nrequests:\n\n```html\n\u003cform action=\"http://\u003cIP\u003e/cgi-bin/hotspotlogin.cgi\" method=\"post\" enctype=\"text/plain\"\u003e\n\u003cinput type=\"hidden\" name=\"res\" value=\"failed\u0026challenge=\u0026quot;\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cspan\u0026quot;\"\u003e\n\u003cinput type=\"submit\" value=\"challenge\"\u003e\n\u003c/form\u003e\n```\n\n## Timeline ##\n\n* `2018-04-10` identification of vulnerability in version RUT9XX_R_00.04.161\n* `2018-04-16` re-test of version RUT9XX_R_00.04.172\n* `2018-04-16` initial vendor contact through public address\n* `2018-04-18` vendor response with security contact\n* `2018-04-19` disclosed vulnerability to vendor security contact\n* `2018-04-26` vendor released fix in version RUT9XX_R_00.04.233\n* `2018-07-09` notify vendor about incomplete fix in version RUT9XX_R_00.05.00.5\n* `2018-07-19` vendor released fix in version RUT9XX_R_00.05.01.1\n* `2018-07-25` re-test of version RUT9XX_R_00.05.01.2\n* `2018-09-25` request CVE from MITRE\n* `2018-09-26` MITRE assigned CVE-2018-17533\n* `2018-10-11` public disclosure\n\n## References ##\n\n* Firmware Changelog: \u003chttps://wiki.teltonika.lt/index.php?title=RUT9xx_Firmware\u003e\n\n## Credits ##\n\n* David Gnedt ([SBA Research](https://www.sba-research.org/))\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "PACKETSTORM",
        "id": "149781"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-17533",
        "trust": 3.1
      },
      {
        "db": "PACKETSTORM",
        "id": "149781",
        "trust": 2.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053",
        "trust": 0.8
      },
      {
        "db": "EXPLOITALERT",
        "id": "31168",
        "trust": 0.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "PACKETSTORM",
        "id": "149781"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "id": "VAR-201810-0456",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      }
    ],
    "trust": 1.6
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:43:50.779000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://teltonika.lt/"
      },
      {
        "title": "Patch for TeltonikaRUT9XX Cross-Site Scripting Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/163897"
      },
      {
        "title": "Teltonika RUT9XX Repair measures for router cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=85808"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "http://packetstormsecurity.com/files/149781/teltonika-rut9xx-reflected-cross-site-scripting.html"
      },
      {
        "trust": 1.7,
        "url": "https://github.com/sbaresearch/advisories/tree/public/2018/sba-adv-20180410-01_teltonika_cross_site_scripting"
      },
      {
        "trust": 1.6,
        "url": "http://seclists.org/fulldisclosure/2018/oct/29"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17533"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17533"
      },
      {
        "trust": 0.6,
        "url": "https://www.exploitalert.com/view-details.html?id=31168"
      },
      {
        "trust": 0.1,
        "url": "https://teltonika.lt/)"
      },
      {
        "trust": 0.1,
        "url": "http://\u003cip\u003e/cgi-bin/hotspotlogin.cgi?res=failed\u0026userurl=\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cspan"
      },
      {
        "trust": 0.1,
        "url": "https://teltonika.lt/product/rut955/)"
      },
      {
        "trust": 0.1,
        "url": "http://\u003cip\u003e/cgi-bin/hotspotlogin.cgi\""
      },
      {
        "trust": 0.1,
        "url": "https://teltonika.lt/product/rut955/\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://wiki.teltonika.lt/index.php?title=rut9xx_firmware\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.sba-research.org/))"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "PACKETSTORM",
        "id": "149781"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "db": "PACKETSTORM",
        "id": "149781"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-06-19T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "date": "2019-01-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "date": "2018-10-12T16:22:13",
        "db": "PACKETSTORM",
        "id": "149781"
      },
      {
        "date": "2018-10-15T19:29:01.837000",
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "date": "2018-10-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-06-19T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-18495"
      },
      {
        "date": "2019-01-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      },
      {
        "date": "2018-11-30T14:09:02.167000",
        "db": "NVD",
        "id": "CVE-2018-17533"
      },
      {
        "date": "2018-10-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Teltonika RUT9XX Router firmware cross-site scripting vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011053"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "xss",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "149781"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-711"
      }
    ],
    "trust": 0.7
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.