CVE-2014-9020: XSS
Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected products and codebases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9020?
CVE-2014-9020 has a medium severity rating due to the potential for remote code execution via XSS attacks.
How do I fix CVE-2014-9020?
To fix CVE-2014-9020, ensure that you apply any available firmware updates from ZTE for the ZXDSL 831 and 831CII devices.
What equipment is affected by CVE-2014-9020?
CVE-2014-9020 affects the ZTE ZXDSL 831 and 831CII models.
Is CVE-2014-9020 exploitable from the internet?
Yes, CVE-2014-9020 is exploitable remotely, allowing attackers to inject malicious scripts through the Quick Stats page.
What is the impact of exploiting CVE-2014-9020?
Exploiting CVE-2014-9020 can allow attackers to perform actions as an authenticated user and capture sensitive information.