CVE-2013-6786 Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "f...
MediumCVSS 4.3
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| allegrosoft rompager | <= 4.07 | No fix listed |
| dlink dsl-2640r | All versions | No fix listed |
| dlink dsl-2641r | All versions | No fix listed |
| Huawei mt882 | All versions | No fix listed |
| sitecom wl-174 | All versions | No fix listed |
| tp-link td-8816 | All versions | No fix listed |
| zyxel p-660hw d1 | All versions | No fix listed |
References
- antoniovazquezblanco.github.io exploit
- 99694 vdb-entry
- osvdb.org exploit