Skip to content
OpenAdvisories
Medium VDE-2026-071 3 CVEs

JUMO: Allegro RomPager webserver vulnerability in JUMO mTRONT, DICON touch, AQUIS touch devices

Published Jun 23, 2026 · Updated Jul 8, 2026 · Revision 2

Vendor: Jumo Product: AQUIS touch Product: DICON touch Product: mTRON T Central Processing Unit Product: mTRON T Multifunction panel 840

Summary

Multiple products from JUMO are affected by webserver vulnerability "CVE-2013-6786, CVE-2014-9222, CVE-2014-9223. This vulnerability leads to DOS of the device by using a misfortune cookie and reflected XSS attacks.

Details

Impact
DOS vulnerability of the device in case of Misfortune Cookie.
XSS vulnerability allows remote attackers to inject arbitrary web script or HTML.

Mitigation
Control the access to the devices webserver by using a Firewall to block traffic from untrusted networks.

Remediation
Update to latest software version.
For latest software version please contact
support@jumo.net.

Fixed for:
- Version 248.05.02 for JUMO mTRON T Central Processing Unit
- Version 249.05.03 for JUMO mTRON T Multifunction panel 840
- Version 266.04.07 for JUMO DICON touch
- Version 304.09.04 for JUMO AQUIS touch

Vulnerabilities 3

  • Unscored —
    CVE-2013-6786

    Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882,…

  • Unscored —
    CVE-2014-9222 Public exploit EPSS 74%

    AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows r…

  • Unscored —
    CVE-2014-9223

    Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and produc…

Revision history

  1. #2.0.0

    Updated the relationship identifier and adjusted the starting versions in the product tree version ranges.

  2. #1.0.0

    initial release

References