Summary
Successful exploitation of this vulnerability allows an attacker's malicious script to execute in the browser of any authenticated user or administrator who accesses the affected interface. This could lead to compromise of user sessions, execution of unauthorized actions with the victim's privileges, exposure or manipulation of sensitive data, and degradation of overall system integrity.
Vulnerabilities 1
-
High 8.4
CP Plus 8 Ch. Network Video Recorder Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on t…
Revision history
-
#1
Initial Publication
References
-
ICSA Advisory ICSA-26-148-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
-
Recommended Practices
https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
-
Recommended Practices
https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks