Unscored severity · published Jul 7, 2014
CVE-2013-7389
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev
–
CVSS
27.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)27.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Dir-645 · Dlink
a1 · source: NVD
DF
Dir-645 Firmware · Dlink
through 1.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7389
osvdb.org
http://osvdb.org/show/osvdb/95910
osvdb.org
http://osvdb.org/show/osvdb/95952
osvdb.org
http://osvdb.org/show/osvdb/95953
Exploit
http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt
Patch
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008
www.securityfocus.com
http://www.securityfocus.com/bid/61579
More from Dir-645
8.8
CVE-2015-2051
D-Link DIR-645 Router Remote Code Execution Vulnerability