** UNSUPPORTED WHEN ASSIGNED ** Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware updates to address this issue.
References
| Link | Resource |
|---|---|
| https://tbutler.org/2021/04/29/teradek-vulnerability-advisory | Exploit Third Party Advisory |
| https://tbutler.org/2021/04/29/teradek-vulnerability-advisory | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://tbutler.org/2021/04/29/teradek-vulnerability-advisory - Exploit, Third Party Advisory |
28 Feb 2023, 15:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://tbutler.org/2021/04/29/teradek-vulnerability-advisory - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:o:teradek:slice_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:teradek:slice:-:*:*:*:*:*:*:* |
|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
03 Feb 2023, 18:36
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-03 18:15
Updated : 2024-11-21 06:15
NVD link : CVE-2021-37373
Mitre link : CVE-2021-37373
CVE.ORG link : CVE-2021-37373
JSON object : View
Products Affected
teradek
- slice
- slice_firmware
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')