Sign-up

ID

VAR-201410-0378


CVE

CVE-2014-4871


TITLE

NetCommWireless NB604N ADSL2+ Router 'wlsecurity.html' HTML Injection Vulnerability

Trust: 0.9

sources: CNVD: CNVD-2014-06598 // BID: 70253

DESCRIPTION

Cross-site scripting (XSS) vulnerability in wlsecurity.html on NetCommWireless NB604N routers with firmware before GAN5.CZ56T-B-NC.AU-R4B030.EN allows remote attackers to inject arbitrary web script or HTML via the wlWpaPsk parameter. NetComm Wireless Provided by NB604N Is Wireless -> Security page (wlsecurity.html) Variables that are not sanitized wlWpaPsk Value of Javascript variable wpaPskKey Stored cross-site scripting vulnerability (CWE-79) Exists. The NetCommWireless NB604N is a router device. Sensitive information or hijacking user sessions. NetCommWireless NB604N is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. NetCommWireless NB604N GAN5.CZ56T-B-NC.AU-R4B010.EN is vulnerable; other versions may also be affected. NetComm Wireless NB604N Routers is a wireless router product of Australia NetComm Wireless company

Trust: 3.24

sources: NVD: CVE-2014-4871 // CERT/CC: VU#941108 // JVNDB: JVNDB-2014-004570 // CNVD: CNVD-2014-06598 // BID: 70253 // VULHUB: VHN-72812

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-06598

AFFECTED PRODUCTS

vendor:netcommwirelessmodel:nb604nscope:lteversion:gan5.cz56t-b-nc.au-r4b010.en

Trust: 1.0

vendor:netcommwirelessmodel:nb604nscope:eqversion: -

Trust: 1.0

vendor:netcommmodel: - scope: - version: -

Trust: 0.8

vendor:netcommmodel:nb604nscope: - version: -

Trust: 0.8

vendor:netcommmodel:nb604nscope:eqversion:gan5.cz56t-b-nc.au-r4b010.en

Trust: 0.8

vendor:netcommmodel:wireless limited. netcommwireless nb604n gan5.cz56t-b-nc.au-r4b010.enscope: - version: -

Trust: 0.6

vendor:netcommwirelessmodel:nb604nscope:eqversion:gan5.cz56t-b-nc.au-r4b010.en

Trust: 0.6

sources: CERT/CC: VU#941108 // CNVD: CNVD-2014-06598 // JVNDB: JVNDB-2014-004570 // CNNVD: CNNVD-201410-133 // NVD: CVE-2014-4871

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4871
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-4871
value: LOW

Trust: 0.8

IPA: JVNDB-2014-004570
value: LOW

Trust: 0.8

CNVD: CNVD-2014-06598
value: LOW

Trust: 0.6

CNNVD: CNNVD-201410-133
value: MEDIUM

Trust: 0.6

VULHUB: VHN-72812
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-4871
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: CVE-2014-4871
severity: LOW
baseScore: 3.5
vectorString: NONE
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

IPA: JVNDB-2014-004570
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2014-06598
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-72812
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#941108 // CNVD: CNVD-2014-06598 // VULHUB: VHN-72812 // JVNDB: JVNDB-2014-004570 // CNNVD: CNNVD-201410-133 // NVD: CVE-2014-4871

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-72812 // JVNDB: JVNDB-2014-004570 // NVD: CVE-2014-4871

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201410-133

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201410-133

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-004570

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#941108

PATCH
title:Support - ADSL2+ Wireless N300 Modem Router - NB604Nurl:http://support.netcommwireless.com/product/adsl/nb604n
Trust: 0.8
title:\302\240\302\240\302\240\302\240\302\240NetCommWireless NB604N ADSL2+ Router 'wlsecurity.html' patch for HTML injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/50765
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-06598 // 
            
            
            
            JVNDB: JVNDB-2014-004570

EXTERNAL IDS
db:CERT/CCid:VU#941108
Trust: 3.9
db:NVDid:CVE-2014-4871
Trust: 3.4
db:BIDid:70253
Trust: 2.0
db:JVNid:JVNVU93498805
Trust: 0.8
db:JVNDBid:JVNDB-2014-004570
Trust: 0.8
db:CNNVDid:CNNVD-201410-133
Trust: 0.7
db:CNVDid:CNVD-2014-06598
Trust: 0.6
db:VULHUBid:VHN-72812
Trust: 0.1
sources:
            
            
            CERT/CC: VU#941108 // 
            
            
            
            CNVD: CNVD-2014-06598 // 
            
            
            
            VULHUB: VHN-72812 // 
            
            
            
            BID: 70253 // 
            
            
            
            JVNDB: JVNDB-2014-004570 // 
            
            
            
            CNNVD: CNNVD-201410-133 // 
            
            
            
            NVD: CVE-2014-4871

REFERENCES
url:http://www.kb.cert.org/vuls/id/941108
Trust: 3.1
url:http://www.securityfocus.com/bid/70253
Trust: 1.1
url:http://cwe.mitre.org/data/definitions/79.html
Trust: 0.8
url:http://support.netcommwireless.com/product/adsl/nb604n
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4871
Trust: 0.8
url:http://jvn.jp/vu/jvnvu93498805/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4871
Trust: 0.8
sources:
            
            
            CERT/CC: VU#941108 // 
            
            
            
            CNVD: CNVD-2014-06598 // 
            
            
            
            VULHUB: VHN-72812 // 
            
            
            
            JVNDB: JVNDB-2014-004570 // 
            
            
            
            CNNVD: CNNVD-201410-133 // 
            
            
            
            NVD: CVE-2014-4871

CREDITS
Katie Duczmal
Trust: 0.3
sources:
            
            
            BID: 70253

SOURCES
db:CERT/CCid:VU#941108
db:CNVDid:CNVD-2014-06598
db:VULHUBid:VHN-72812
db:BIDid:70253
db:JVNDBid:JVNDB-2014-004570
db:CNNVDid:CNNVD-201410-133
db:NVDid:CVE-2014-4871

LAST UPDATE DATE
2025-04-13T23:14:42.536000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#941108date:2014-10-06T00:00:00
db:CNVDid:CNVD-2014-06598date:2014-10-11T00:00:00
db:VULHUBid:VHN-72812date:2015-10-06T00:00:00
db:BIDid:70253date:2014-10-06T00:00:00
db:JVNDBid:JVNDB-2014-004570date:2014-10-09T00:00:00
db:CNNVDid:CNNVD-201410-133date:2014-10-14T00:00:00
db:NVDid:CVE-2014-4871date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CERT/CCid:VU#941108date:2014-10-06T00:00:00
db:CNVDid:CNVD-2014-06598date:2014-10-11T00:00:00
db:VULHUBid:VHN-72812date:2014-10-07T00:00:00
db:BIDid:70253date:2014-10-06T00:00:00
db:JVNDBid:JVNDB-2014-004570date:2014-10-09T00:00:00
db:CNNVDid:CNNVD-201410-133date:2014-10-14T00:00:00
db:NVDid:CVE-2014-4871date:2014-10-07T10:55:04.433