CVE-2023-2395: Netgear SRX5308 Web Management Interface cross site scripting

Published Apr 28, 2023

Updated

A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web Management Interface. The manipulation of the argument Login.userAgent leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227673 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

4 affected components

All of the following

Netgear Srx5308 Firmware=4.3.5-3

Netgear SRX5308

Netgear Srx5308 Firmware=4.3.5-3

Netgear SRX5308

Event History

Apr 28, 2023

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-2395?

The severity of CVE-2023-2395 is medium.

What is the affected software version of CVE-2023-2395?

The affected software version of CVE-2023-2395 is Netgear SRX5308 Firmware 4.3.5-3.

How does CVE-2023-2395 affect the Web Management Interface?

CVE-2023-2395 allows for cross site scripting attacks on the Web Management Interface of Netgear SRX5308.

Is CVE-2023-2395 exploitable remotely?

Yes, CVE-2023-2395 can be exploited remotely.

What is the CWE classification of CVE-2023-2395?

CVE-2023-2395 is classified as CWE-79 (Cross-Site Scripting).