CVE-2019-5985 Cross-site scripting in Hikari Denwa router/Home GateWay
Remote attackers can inject arbitrary web script or HTML into Hikari Denwa routers, potentially compromising user sessions or data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-5985?
CVE-2019-5985 is a medium-severity cross-site scripting vulnerability in Hikari Denwa router/Home GateWay, published on 12 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, RS-500KI firmware version Ver.01.00.0070 and earlier, PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier, and RS-500MI firmware version Ver.03.01.0019 and earlier, and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, and PR-500MI/RT-500MI firmware version Ver.01.01.0011 and earlier) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Weakness: CWE-79
Which versions are affected by CVE-2019-5985?
It affects 46 products.
Products include Ntt-East Pr-400ki Firmware, Ntt-East Pr-400mi Firmware, Ntt-East Pr-400ne Firmware, Ntt-East Pr-500ki Firmware, Ntt-East Pr-500mi Firmware, Ntt-East Pr-S300hi Firmware and 40 more.
How do I fix CVE-2019-5985?
No fix has been published for CVE-2019-5985 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-5985 being exploited?
There is no known exploitation of CVE-2019-5985 in the wild and no public exploit code.
Other vulnerabilities in Hikari Denwa router/Home GateWay
Sources
Also known as GHSA-j2h4-m4xq-p47m.