Vulnerabilities > Netis Systems > Dl4343 Firmware > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-12-30 CVE-2019-20076 Cross-site Scripting vulnerability in Netis-Systems Dl4343 Firmware
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).
network
low complexity
netis-systems CWE-79
6.1
6.1
2019-12-30 CVE-2019-20075 Cross-site Scripting vulnerability in Netis-Systems Dl4343 Firmware
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
network
low complexity
netis-systems CWE-79
6.1
6.1
2019-12-30 CVE-2019-20073 Cross-site Scripting vulnerability in Netis-Systems Dl4343 Firmware
On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).
network
low complexity
netis-systems CWE-79
6.1
6.1
2019-12-30 CVE-2019-20072 Cross-site Scripting vulnerability in Netis-Systems Dl4343 Firmware
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).
network
low complexity
netis-systems CWE-79
6.1
6.1
2019-12-30 CVE-2019-20071 Cross-Site Request Forgery (CSRF) vulnerability in Netis-Systems Dl4343 Firmware
On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.
network
low complexity
netis-systems CWE-352
6.5
6.5
2019-12-30 CVE-2019-20070 Cross-site Scripting vulnerability in Netis-Systems Dl4343 Firmware
On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).
network
low complexity
netis-systems CWE-79
6.1
6.1