NVD

Id
35842  
Name
CVE-2014-9021  
Description
Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-11-20  
Modified Date
2014-11-20  
Seq
2014-9021  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
183514 35842 CVE-2014-9021 http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html  View
183515 35842 CVE-2014-9021 20141106 ZTE ZXDSL 831 Multiple Cross Site Scripting  View
183516 35842 CVE-2014-9021 70985  View
183517 35842 CVE-2014-9021 zte-zxdsl831-tr69cfg-xss(98565)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16697 JVNDB-2014-005572 ZTE ZXDSL 831 におけるクロスサイトスクリプティングの脆弱性 ZTE ZXDSL 831 には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2014-9021 76314 CVE-2014-9021 35842 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005572.html 2014-11-06 2014-11-21 View