CVE-2021-39278 Cross-site scripting in n/a

Medium 6.1 Published 7 Sep 2021 Updated 4 Aug 2024

Reflected XSS in MOXA industrial devices allows attackers to execute scripts via the Config Import menu, potentially compromising user sessions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-39278?

CVE-2021-39278 is a medium-severity cross-site scripting vulnerability in n/a, published on 7 Sep 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.

Weakness: CWE-79

Which versions are affected by CVE-2021-39278?

It affects 12 products.

Products include Moxa Oncell G3470a-Lte-Eu-T Firmware, Moxa Oncell G3470a-Lte-Eu Firmware, Moxa Tap-323-Eu-Ct-T Firmware, Moxa Tap-323-Jp-Ct-T Firmware, Moxa Tap-323-Us-Ct-T Firmware, Moxa Wac-1001-T Firmware and 6 more.

How do I fix CVE-2021-39278?

No fix has been published for CVE-2021-39278 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-39278 being exploited?

There is no known exploitation of CVE-2021-39278 in the wild and no public exploit code.

Sources

Also known as GHSA-vw6h-px5h-9j7r.