CVE-2023-24496

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.57% chance of exploitation in the next 30 days, 45th percentile

Published

2023-07-06

Updated

2025-11-04

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704

References

• CVE Record
• NVD entry

Related

• CVE-2023-24489
• CVE-2023-24497
• CVE-2023-24488
• CVE-2023-2451
• CVE-2023-24487
• CVE-2023-24517