Skip to content
OpenAdvisories
Critical ICSA-25-044-15 2 CVEs

ORing IAP-420

Published Feb 13, 2025 · Updated Feb 13, 2025

Vendor: ORing Product: IAP-420

Summary

Successful exploitation of these vulnerabilities could allow an attacker to invoke commands to compromise the device via the management interface.

Vulnerabilities 2

  • High 8.7
    CVE-2024-5411 EPSS 23%

    Command Injection

    Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects IAP-420 version 2.01e and below.

    ORing IAP-420
  • High 8.3
    CVE-2024-5410 EPSS 14%

    Stored Cross-Site Scripting

    Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below.

    ORing IAP-420

Revision history

  1. #1

    Initial Publication

References