PT-2020-10299
CVE-2019-19941
·
Published
2020-03-16
·
Updated
2021-02-03
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Swisscom Centro Grande versions prior to 6.16.12
Description
The issue is related to missing hostname validation, allowing a remote attacker to inject its local IP address as a domain entry in the DNS service of the router via crafted hostnames in DHCP requests, causing XSS.
Recommendations
For versions prior to 6.16.12, update to version 6.16.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS service of the router to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾