Medium severity6.1NVD Advisory· Published Dec 6, 2018· Updated Jun 17, 2026
CVE-2018-19922
CVE-2018-19922
Description
Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request.
Affected products
2- cpe:2.3:o:actiontec:c1000a_firmware:*:*:*:*:*:*:*:*Range: <=cac004-31.30l.95
Patches
Vulnerability mechanics
References
1- github.com/logern5/c1000a_xss/blob/master/README.mdnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.