CVE-2013-5703 Cross-site scripting in n/a
Remote attackers can execute arbitrary JavaScript and modify router settings via a crafted SSID value in DrayTek Vigor routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-5703?
CVE-2013-5703 is a medium-severity cross-site scripting vulnerability in n/a, published on 22 Oct 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DrayTek Vigor 2700 router 2.8.3 allows remote attackers to execute arbitrary JavaScript code, and modify settings or the DNS cache, via a crafted SSID value that is not properly handled during insertion into the sWlessSurvey value in variables.js.
Weakness: CWE-78
Which versions are affected by CVE-2013-5703?
It affects 2 products.
Products include Draytek Vigor 2700 Router, Draytek Vigor 2700 Router Firmware.
How do I fix CVE-2013-5703?
No fix has been published for CVE-2013-5703 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2013-5703 being exploited?
There is no known exploitation of CVE-2013-5703 in the wild and no public exploit code.
Sources
Also known as GHSA-3pwq-cm7p-cvv5.