ID
VAR-202403-2494
CVE
CVE-2024-28095
TITLE
schoolbox Cross-site scripting vulnerability in
Trust: 0.8
DESCRIPTION
News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users. schoolbox Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. The Tenda AC15 is a dual-band wireless router launched by Shenzhen Jixiang Tengda Technology Co., Ltd. in October 2015. It supports the 802.11ac protocol and offers a theoretical transmission rate of 1900 Mbps (600 Mbps in the 2.4 GHz band and 1300 Mbps in the 5 GHz band). The Tenda AC15 suffers from a stack buffer overflow vulnerability. This vulnerability stems from the failure to properly validate the length of input data in the firewallEn parameter of the formSetFirewallCfg method in the /goform/SetFirewallCfg page. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | schoolbox | model: | schoolbox | scope: | lt | version: | 23.1.3 | Trust: 1.0 |
| vendor: | schoolbox | model: | schoolbox | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | schoolbox | model: | schoolbox | scope: | eq | version: | 23.1.3 | Trust: 0.8 |
| vendor: | schoolbox | model: | schoolbox | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | ac15 15.03.20 multi | scope: | - | version: | - | Trust: 0.6 |
| vendor: | tenda | model: | ac15 | scope: | eq | version: | 15.03.05.18 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-79 | Trust: 1.0 |
| problemtype: | Cross-site scripting (CWE-79) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | Cross-site scripting (CWE-79) [ others ] | Trust: 0.8 |
PATCH
| title: | Patch for Tenda AC15 formSetFirewallCfg method stack buffer overflow vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/743916 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-28095 | Trust: 3.2 |
| db: | JVNDB | id: | JVNDB-2024-018159 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-24292 | Trust: 0.6 |
REFERENCES
| url: | https://www.themissinglink.com.au/security-advisories/cve-2024-28095 | Trust: 2.4 |
| url: | https://schoolbox.education/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-28095 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-24292 |
| db: | JVNDB | id: | JVNDB-2024-018159 |
| db: | NVD | id: | CVE-2024-28095 |
LAST UPDATE DATE
2025-11-19T23:18:27.347000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-24292 | date: | 2025-10-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-018159 | date: | 2025-02-06T01:20:00 |
| db: | NVD | id: | CVE-2024-28095 | date: | 2025-02-05T17:22:23.773 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-24292 | date: | 2025-10-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-018159 | date: | 2025-02-06T00:00:00 |
| db: | NVD | id: | CVE-2024-28095 | date: | 2024-03-07T04:15:07.527 |