CVE Intelligence
Skip to main content

CVE-2018-0679

CVE-2018-0679 Vulnerability Analysis & Exploit Intelligence

Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.

Published Updated Sources: cvelistV5, jpcert

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

1%

chance of exploitation in 30 days

Affects

fxc

multiple_fxc_inc_network_devices_managed_ethernet_switch_fxc5210_5218_5224_firmware_prior_to_version_ver1_00_22_managed_ethernet_switch_fxc5426f_firmware_prior_to_version_ver1_00_06_managed_ethernet_switch_fxc5428_firmware_prior_to_version_ver1_00_07_power_over_ethernet_poe_switch_fxc5210pe_5218pe_5224pe_firmware_prior_to_version_ver1_00_14_and_wireless_lan_router_ae1021_ae1021pe_firmware_all_versions

CVSS base

Unscored

no source published a base score

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

fxc

Products (1)

multiple fxc inc network devices managed ethernet switch fxc5210 5218 5224 firmware prior to version ver1 00 22 managed ethernet switch fxc5426f firmware prior to version ver1 00 06 managed ethernet switch fxc5428 firmware prior to version ver1 00 07 power over ethernet poe switch fxc5210pe 5218pe 5224pe firmware prior to version ver1 00 14 and wireless lan router ae1021 ae1021pe firmware all versions

Detection

Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.

  • Search application, proxy, and WAF logs for requests touching /5218/5224, /5218PE/5224PE, /AE1021PE.

References

2 on the record

Elsewhere on this site

  • fxcevery CVE for this vendor

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.