Medium severity · published Jul 2, 2024
CVE-2023-41922
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
P1/P2 · Kiloview
All through 4.8.2605 · source: vendor
PF
P1 Firmware · Kiloview
All versions, or not specified · source: NVD
PF
P2 Firmware · Kiloview
All versions, or not specified · source: NVD
P4
P1 4g Video Encoder Firmware · Kiloview
through 4.8.2605 · source: CISA
P4
P2 4g Video Encoder Firmware · Kiloview
through 4.8.2605 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41922
Third Party Advisory
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
More from P1/P2
10.0
CVE-2023-41918
Missing Authentication for Critical Function in Kiloview P1/P2 devices
10.0
CVE-2023-41917
Improper input validation in Kiloview P1/P2 devices allows for remote code execution
9.8
CVE-2023-41921
Download of Code Without Integrity Check in Kiloview P1/P2 devices
9.8
CVE-2023-41920
Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
9.8
CVE-2023-41919
Use of Hard-coded Credentials in Kiloview P1/P2 devices