Medium severity · published Jan 8, 2018
CVE-2018-5281
SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens
5.4
CVSS
2.5%
EPSS
No
On KEV
Description
SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Sonicos · Sonicwall
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5281
Third Party Advisory
http://www.securityfocus.com/bid/102443
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0002
Exploit
https://www.vulnerability-lab.com/get_content.php?id=1729
More from Sonicos
9.8
CVE-2024-53704
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
9.8
CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability
9.8
CVE-2020-5135
SonicWall SonicOS Buffer Overflow Vulnerability
9.8
CVE-2025-40600
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption
9.8
CVE-2024-40765
An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute…