medium5.3
CVE-2021-27418
GE UR firmware versions prior to version 8.1x supports web interface with read-only access.
Impact
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ge | Multilin B30 Firmware | before 8.10 |
| Ge | Multilin B90 Firmware | before 8.10 |
| Ge | Multilin C60 Firmware | before 8.10 |
| Ge | Multilin C70 Firmware | before 8.10 |
| Ge | Multilin C95 Firmware | before 8.10 |
| Ge | Multilin D30 Firmware | before 8.10 |
| Ge | Multilin D60 Firmware | before 8.10 |
| Ge | Multilin F35 Firmware | before 8.10 |
| Ge | Multilin F60 Firmware | before 8.10 |
| Ge | Multilin G30 Firmware | before 8.10 |
| Ge | Multilin G60 Firmware | before 8.10 |
| Ge | Multilin L30 Firmware | before 8.10 |