CVE-2024-3125

Vulnerability

Description A stored cross-site scripting (XSS) vulnerability exists in the web portal of Zebra Technologies ZTC GK420d printers, specifically in the Alert Setup page at /settings [1]. The vulnerability stems from insufficient sanitization of the Address input field, allowing an attacker to inject arbitrary JavaScript code that gets stored and executed when the page is reloaded [1].

Exploitation

Prerequisites Exploitation requires network access to the printer's web interface and valid login credentials (default or obtained). An authenticated attacker navigates to the Alert Setup page, adds a new alert message, and inserts a malicious payload into the Address field [1]. Upon returning to the Alert Setup page, the stored payload executes in the context of the administrator's session [1].

Impact

Successful exploitation enables arbitrary JavaScript execution within the victim's browser, potentially leading to session hijacking, credential theft, redirection to malicious sites, or further attacks against connected devices [1]. The CVSS v3 base score is 2.4 (Low), indicating limited impact or complexity, but the vendor has not responded to disclosure [1].

Mitigation

No official patch is available as Zebra Technologies did not respond to the disclosure [1]. Mitigations include restricting network access to the printer's web interface, using strong passwords, and monitoring for suspicious activity. Users should consider isolating the device on a trusted network segment.