CVE-2020-25498: Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter

Medium severity · published Jan 6, 2021

CVE-2020-25498

Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter

4.8

CVSS

1.1%

EPSS

On KEV

Description

Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.1% · higher than 65% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

777vr1 Firmware · Beetel

All versions, or not specified · source: NVD

Affected product

777vr1 Firmware

Beetel

All 777vr1 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-25498

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-25498

Exploit

https://github.com/the-girl-who-lived/CVE-2020-25498

Exploit

https://youtu.be/qeVHvmS5wtI

Exploit

https://youtu.be/u_6yBIMF74A