Description
Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request validation. Attackers can exploit cross-site request forgery to change passwords and inject stored cross-site scripting payloads through unvalidated GET parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BTicino S.p.A. | Legrand BTicino Driver Manager F454 | 1.0.51, 1.1.14 | — |
References
- ExploitDB-46850 exploit
- BTicino Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2019-5521) third-party-advisory
- Zero Science Lab Disclosure (ZSL-2019-5522) third-party-advisory