CVE-2014-1407

Name of the Vulnerable Software and Affected Versions Conceptronic C54APM access point with runtime code 1.26

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in certain actions. This can be achieved by exploiting the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or the wlan-url parameter to goform/formWlanSetup.

Recommendations For Conceptronic C54APM access point with runtime code 1.26, consider restricting access to the goform/formWlSiteSurvey and goform/formWlanSetup API endpoints until a patch is available. Avoid using the submit-url and wlan-url parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.