Medium severity · published Nov 11, 2024
CVE-2024-51188
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualServerName_1.1.10.0.0…
4.8
CVSS
1%
EPSS
No
On KEV
Description
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualServerName_1.1.10.0.0 parameter on the /virtual_server.htm page.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tew-651br Firmware · Trendnet
2.04b1 · source: NVD
TF
Tew-652brp Firmware · Trendnet
3.04b01 · source: NVD
TF
Tew-652bru Firmware · Trendnet
1.00b12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51188
Exploit
https://github.com/4hsien/CVE-vulns/blob/main/TRENDnet/TEW-652BRP/XSS_Virtual_Server/README.md
Broken Link
https://www.trendnet.com/products/product-detail?prod=235_TEW-651BR
Broken Link
https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP
Broken Link
https://www.trendnet.com/products/product-detail?prod=245_TEW-652BRU
More from Tew-651br Firmware
9.8
CVE-2015-1187
D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
9.8
CVE-2019-11400
An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices
9.8
CVE-2019-11399
An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices
4.8
CVE-2024-51190
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_ApplicationName_1.1.6.0.0…
4.8
CVE-2024-51189
TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1.1.0.0 parameter on…