Billion · Billion Smart Energy Router Sg600R2 · CVE-2019-14918
**Name of the Vulnerable Software and Affected Versions**
Billion Smart Energy Router SG600R2 Firmware version 3.02.rc6
**Description**
The issue allows an attacker to inject arbitrary HTML/JavaScript code, achieving client-side code execution. This is done via crafted DHCP request packets to the "etc ro/web/internet/dhcpcliinfo.asp" endpoint.
**Recommendations**
For Billion Smart Energy Router SG600R2 Firmware version 3.02.rc6, consider disabling access to the "etc ro/web/internet/dhcpcliinfo.asp" endpoint until a patch is available.