CVE-2013-7389

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3) receiver parameter to bsc_sms_send.php.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

27.75% chance of exploitation in the next 30 days, 98th percentile

Published

2014-07-07

Updated

2024-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_hedwig_cgi_bof.…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27283

References

• CVE Record
• NVD entry

Related

• CVE-2013-7387
• CVE-2013-7390
• CVE-2013-7382
• CVE-2013-7392
• CVE-2013-7379
• CVE-2013-7409