CVE-2018-25038

A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
References
Link Resource
https://alquimistadesistemas.com/auditando-router-thomson-tcw710 Exploit Third Party Advisory
https://vuldb.com/?id.126699 Permissions Required Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:technicolor:thomson_tcw710_firmware:st5d.10.05:*:*:*:*:*:*:*
cpe:2.3:h:technicolor:thomson_tcw710:-:*:*:*:*:*:*:*

History

21 Jun 2022, 14:34

Type Values Removed Values Added
References (MISC) https://vuldb.com/?id.126699 - (MISC) https://vuldb.com/?id.126699 - Permissions Required, Third Party Advisory
References (MISC) https://alquimistadesistemas.com/auditando-router-thomson-tcw710 - (MISC) https://alquimistadesistemas.com/auditando-router-thomson-tcw710 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 3.5
v3 : 5.4
CWE CWE-79
First Time Technicolor thomson Tcw710 Firmware
Technicolor
Technicolor thomson Tcw710
CPE cpe:2.3:o:technicolor:thomson_tcw710_firmware:st5d.10.05:*:*:*:*:*:*:*
cpe:2.3:h:technicolor:thomson_tcw710:-:*:*:*:*:*:*:*

12 Jun 2022, 08:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-12 08:15

Updated : 2023-12-10 14:22


NVD link : CVE-2018-25038

Mitre link : CVE-2018-25038

CVE.ORG link : CVE-2018-25038


JSON object : View

Products Affected

technicolor

  • thomson_tcw710_firmware
  • thomson_tcw710
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)