Vulnerability · Published May 26, 2020 · Assigned by hackerone

CVE-2020-8170

Medium 6.1

In plain English

A medium-severity cross-site scripting in AirMax AirOS for TI, XW and XM boards. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.0%top 36.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

Affected products (as reported)

Vendor	Product	Versions
n/a	AirMax AirOS for TI, XW and XM boards	Affected firmware versions are v6.2.0 and priorFixed firmware version is v6.3.0

Weakness: CWE-79

References

https://www.ui.com/download/airmax-m x_refsource_MISC
https://community.ui.com/releases/Security-advisory-bulletin-010-010/36a8448a-7dbf-4d30-bb54-398c44591dd4 x_refsource_MISC
https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83 x_refsource_MISC