CVE-2016-2274

Vulnerability

The Adcon Telemetry A850 Telemetry Gateway Base Station web interface fails to neutralize or incorrectly neutralizes user-controllable input before placing it in output, leading to a cross-site scripting (XSS) vulnerability [1]. All versions of the A850 Telemetry Gateway Base Station are affected [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending crafted input to the web interface [1]. No authentication is required, and the attacker can inject arbitrary JavaScript that executes in the context of the affected application [1].

Impact

Successful exploitation allows the attacker to inject arbitrary JavaScript, which may affect the integrity of the system [1]. This could lead to actions such as session hijacking, defacement, or redirection to malicious sites, depending on the application's context.

Mitigation

Adcon Telemetry has produced a new firmware version to mitigate this vulnerability [1]. Users should upgrade to the latest firmware version provided by Adcon. The ICS-CERT advisory recommends applying the update to reduce risk [1].