CVE-2021-38428
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.
- Score
- CVSS 3.1 5.5 Medium
- Status
- Modified - ics-cert@hq.dhs.gov
- Published
- 2021-11-03
- Last modified
- 2024-09-17
- Weaknesses
- CWE-79
Affected products
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
