CVE-2022-28717 Cross-site scripting in Rebooter, PoE Rebooter, Scheduler, and Contact Converter
Remote attackers with admin privileges can inject arbitrary scripts into MEIKYO rebooter and scheduler devices, potentially compromising device integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-28717?
CVE-2022-28717 is a medium-severity cross-site scripting vulnerability in MEIKYO ELECTRIC CO.,LTD. Rebooter, PoE Rebooter, Scheduler, and Contact Converter, published on 18 May 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker with the administrative privilege to inject an arbitrary script via unspecified vectors.
Weakness: CWE-79
Which versions are affected by CVE-2022-28717?
It affects 15 products.
Products include Meikyo Poe Boot Nino Poe8m2 Firmware, Meikyo Pose Se10-8a7b1 Firmware, Meikyo Signage Rebooter Rpc-M4hsi Firmware, Meikyo Time Boot Mini Rsc-Mt4h Firmware, Meikyo Time Boot Mini Rsc-Mt4hs Firmware, Meikyo Time Boot Rsc-Mt8f Firmware and 9 more.
How do I fix CVE-2022-28717?
No fix has been published for CVE-2022-28717 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-28717 being exploited?
There is no known exploitation of CVE-2022-28717 in the wild and no public exploit code.
Other vulnerabilities in MEIKYO ELECTRIC CO.,LTD. Rebooter, PoE Rebooter, Scheduler, and Contact Converter
Sources
Also known as GHSA-h2pr-g28q-qw87.