Vulnerabilities > CVE-2023-49296 - Unspecified vulnerability in Arduino Create Agent

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

arduino

NVD

Published: 2023-12-13

Updated: 2024-11-21

Summary

The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vulnerability in versions prior to 1.3.6 affects the endpoint `/certificate.crt` and the way the web interface of the ArduinoCreateAgent handles custom error messages. An attacker that is able to persuade a victim into clicking on a malicious link can perform a Reflected Cross-Site Scripting attack on the web interface of the create agent, which would allow the attacker to execute arbitrary browser client side code. Version 1.3.6 contains a fix for the issue.

Vulnerable Configurations

Part	Description	Count
Application	Arduino Arduino Create Agent 1.1.60 Arduino Create Agent 1.1.251 Arduino Create Agent 1.1.252 Arduino Create Agent 1.2.0 Arduino Create Agent 1.2.1 Arduino Create Agent 1.2.2 Arduino Create Agent 1.2.3 Arduino Create Agent 1.2.4 Arduino Create Agent 1.2.5 Arduino Create Agent 1.2.6 Arduino Create Agent 1.2.7 Arduino Create Agent 1.3.0 Arduino Create Agent 1.3.1 Arduino Create Agent 1.3.2 Arduino Create Agent 1.3.3 Arduino Create Agent 1.3.5	38

Summary

Vulnerable Configurations

References