A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as the static key file in Configuration-Services-Security-OpenVPN-Static Keys. This payload will execute each time a user opens an affected web page. This could be exploited in conjunction with CVE-2020-13259.
References
| Link | Resource |
|---|---|
| https://cxsecurity.com/issue/WLB-2020090063 | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/48807 | Exploit Third Party Advisory VDB Entry |
| https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837 | Product Vendor Advisory |
| https://cxsecurity.com/issue/WLB-2020090063 | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/48807 | Exploit Third Party Advisory VDB Entry |
| https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837 | Product Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 05:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cxsecurity.com/issue/WLB-2020090063 - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/48807 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837 - Product, Vendor Advisory |
Information
Published : 2020-09-17 20:15
Updated : 2024-11-21 05:00
NVD link : CVE-2020-13260
Mitre link : CVE-2020-13260
CVE.ORG link : CVE-2020-13260
JSON object : View
Products Affected
rad
- secflow-1v
- secflow-1v_firmware