CVE-2017-6443
Description
Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter to Forms/oadmin_1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 1.00
Patches
Vulnerability mechanics
Root cause
"The application fails to sanitize the W_AD1 POST parameter before storing and later rendering it on a web page, enabling stored cross-site scripting."
Attack vector
An unauthenticated remote attacker sends a POST request to `/Forms/oadmin_1` with the `W_AD1` parameter containing arbitrary JavaScript (e.g., `<script>window.alert(0)</script>`) [ref_id=1][ref_id=2]. The payload is stored persistently and executed in the browser of any user who subsequently visits `/istatus.htm` [ref_id=1][ref_id=2]. The application ships without a password by default, removing any authentication barrier [ref_id=1]. This is a stored (persistent) cross-site scripting attack [CWE-79].
Affected code
The vulnerability resides in the `/Forms/oadmin_1` endpoint of EPSON TMNet WebConfig Ver. 1.00. The `W_AD1` POST parameter is accepted without sanitization and later rendered on the `/istatus.htm` page [ref_id=1][ref_id=2]. No patch files are available in this bundle.
What the fix does
No vendor patch or fix is included in this bundle. The researcher's only mitigation advice is to "consider adding strong authentication to this portal," noting the application ships without a password [ref_id=1]. A proper fix would require neutralizing HTML/JavaScript in the `W_AD1` parameter before storing it and before rendering it on the status page [CWE-79].
Preconditions
- networkThe EPSON TMNet WebConfig application must be reachable over the network.
- authNo authentication is required; the application ships without a password by default.
- inputThe attacker must be able to send a crafted POST request to /Forms/oadmin_1.
Reproduction
1. Send a POST request to `/Forms/oadmin_1` with the body `W_AD1=<script>window.alert(0)</script>&W_Link1=&Submit=SUBMIT` [ref_id=1][ref_id=2]. 2. Browse to `/istatus.htm` — the injected script executes in the browser [ref_id=1][ref_id=2].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- seclists.org/fulldisclosure/2017/Mar/5nvdExploitThird Party AdvisoryVDB Entry
- www.exploit-db.com/exploits/41502/nvdExploitThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/96556nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.