CVE-2023-24497

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the remote_subnet field of the database

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.57% chance of exploitation in the next 30 days, 45th percentile

Published

2023-07-06

Updated

2025-11-04

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704

References

• CVE Record
• NVD entry

Related

• CVE-2023-24496
• CVE-2023-2451
• CVE-2023-24489
• CVE-2023-24517
• CVE-2023-24488
• CVE-2023-24519