Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2014-11-20T17:00:00
Updated: 2024-08-06T13:33:13.520Z
Reserved: 2014-11-20T00:00:00
Link: CVE-2014-9021
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-11-20T17:50:10.147
Modified: 2024-11-21T02:20:06.397
Link: CVE-2014-9021
Redhat
No data.