Unscored severity · published Jan 16, 2014
CVE-2013-6786
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Dsl-2640r · Dlink
All versions, or not specified · source: NVD
DS
Dsl-2641r · Dlink
All versions, or not specified · source: NVD
MT
Mt882 · Huawei
All versions, or not specified · source: NVD
PD
P-660hw D1 · Zyxel
All versions, or not specified · source: NVD
RO
Rompager · Allegrosoft
through 4.07 · source: NVD
TD
Td-8816 · Tp-link
All versions, or not specified · source: NVD
WL
Wl-174 · Sitecom
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6786
Exploit
http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf
osvdb.org
http://osvdb.org/99694
Exploit
http://osvdb.org/ref/99/rompager407.pdf
More from Rompager
8.8
CVE-2024-0522
A vulnerability was found in Allegro RomPager 4.01
–
CVE-2014-9223
Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote attackers to cause a denial of service or…
–
CVE-2014-9222
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that…