CVE-2017-16564: XSS
Published Nov 6, 2017
·Updated
Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148).
Affected Software
2 affected components
Grandstream Ht802 Firmware
Grandstream HT802
Event History
Nov 6, 2017
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-16564.
2
What is the severity rating of CVE-2017-16564?
CVE-2017-16564 has a severity rating of 5.4, which is considered medium.
3
What is the affected software?
The affected software is the Grandstream HT802 devices with the firmware version Grandstream Ht802 Firmware.
4
How does the vulnerability work?
The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field.
5
Is there a fix available for CVE-2017-16564?
It is recommended to update the firmware of the Grandstream HT802 devices to address this vulnerability.