CVE-2018-6529

XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted Treturn parameter to soap.cgi.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2018-03-06

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Dir-860l Firmware (Dlink)
• Dir-865l Firmware (Dlink)
• Dir-868l Firmware (Dlink)

References

• https://github.com/TheBeeMan/Pwning-multiple-dlink-router-via-SOAP-proto