CVE-2023-2587 Cross-site scripting in Remote Management System

High 7.5 Published 22 May 2023 Updated 16 Jan 2025

An attacker can execute scripts in the account context and achieve remote code execution on managed devices via a crafted JSON file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-2587?

CVE-2023-2587 is a high-severity cross-site scripting vulnerability in Teltonika Remote Management System, published on 22 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices.

Weakness: CWE-79

Which versions are affected by CVE-2023-2587?

It affects 1 product.

Products include Teltonika Remote Management System.

How do I fix CVE-2023-2587?

No fix has been published for CVE-2023-2587 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-2587 being exploited?

There is no known exploitation of CVE-2023-2587 in the wild and no public exploit code.

Sources

Also known as GHSA-mrcv-35v6-xwxf.