Stored Cross Site Scripting Vulnerability in Skyworth Router

Vulnerability

The vulnerability exists in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user-supplied input for the L2TP/PPTP Username parameter at the web interface. A remote attacker can supply specially crafted input to this parameter, leading to stored cross-site scripting (XSS) [1].

Exploitation

An attacker needs network access to the router's web interface. No authentication is required if the interface is exposed, but typically the attacker would need to be on the same network or have credentials. The attacker submits a malicious payload as the L2TP/PPTP Username, which is stored and later executed when an administrator or user views the configuration page [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. The attack is stored, meaning the payload persists and affects any user who views the affected page [1].

Mitigation

As of the publication date (2024-01-17), no patch or fixed version has been announced. Users should restrict access to the web interface to trusted networks and monitor for firmware updates from Skyworth. The CERT-In note does not list a workaround [1].