CVE-2023-34412: Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250
A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker to store an arbitrary JavaScript payload on the diagnosis page of the device. That page is loaded immediately after login in to the device and runs the stored payload, allowing the attacker to read and write browser data and reduce system performance.
Other sources
A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-34412.
What is the severity level of CVE-2023-34412?
The severity level of CVE-2023-34412 is high.
Which devices are affected by CVE-2023-34412?
Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower than 7.3.2 are affected by CVE-2023-34412.
How can an attacker exploit CVE-2023-34412?
An authenticated remote attacker can exploit CVE-2023-34412 by storing an arbitrary JavaScript payload on the diagnosis page of the affected devices.
How can I mitigate CVE-2023-34412?
To mitigate CVE-2023-34412, update the firmware of the affected devices to version 7.3.2 or higher.