Vulnerability DatabaseCVE-2024-22780

CVE-2024-22780:
vulnerability analysis and mitigation

Overview

Cross Site Scripting (XSS) vulnerability exists in CA17 TeamsACS version 1.0.1. The vulnerability was discovered and assigned CVE-2024-22780, with initial disclosure on April 2, 2024. The affected system is TeamsACS, which is a TR069 Auto-configuration server specifically designed for Mikrotik devices (GitHub TeamsACS).

Technical details

The vulnerability allows a remote attacker to execute arbitrary code through a crafted script targeting the errmsg parameter. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness has been classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD CVE).

Impact

The successful exploitation of this vulnerability could allow attackers to execute arbitrary code in the context of the user's browser, potentially leading to unauthorized access to sensitive information, session hijacking, or other malicious activities typically associated with XSS attacks (NVD CVE).

Exploitability

The vulnerability is remotely exploitable and requires no authentication. It does require user interaction (UI:R in CVSS vector), suggesting that successful exploitation depends on a user interacting with a malicious payload (NVD CVE).