Stored Cross Site Scripting Vulnerability in Skyworth Router

Vulnerability

The vulnerability exists in Skyworth Router CM5100, version 4.1.1.24, and stems from insufficient validation of user-supplied input for the Network Name (SSID) parameter at the web interface [1]. This allows a remote attacker to inject malicious scripts that are stored on the system.

Exploitation

An attacker can exploit this vulnerability by supplying specially crafted input to the SSID parameter at the web interface of the vulnerable router [1]. The attacker needs network access to the router's web management page but does not require authentication, as the SSID setting can be modified without prior login in some configurations.

Impact

Successful exploitation allows the attacker to perform stored cross-site scripting (XSS) attacks on the targeted system [1]. This can lead to session hijacking, defacement, or redirection to malicious sites within the context of the router's web interface.

Mitigation

As of the publication date (January 17, 2024), CERT-In has noted the vulnerability but no firmware update or patch is mentioned in the reference [1]. Users should monitor vendor advisories for a fixed version. Until a patch is available, restrict access to the router's web interface to trusted networks only.