What is CVE-2017-13994?

CVE-2017-13994 is a medium-severity vulnerability in Loytec Lvis-3me, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-10-05.

How severe is CVE-2017-13994?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Loytec Lvis-3me

CVE-2017-13994

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.009 (55.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Loytec Lvis-3me
Loytec Lvis-3me_firmware
N/a Loytec Lvis-3me — versions LOYTEC LVIS-3ME

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2017-13994?: CVE-2017-13994 is a medium-severity vulnerability in Loytec Lvis-3me, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-10-05.
How severe is CVE-2017-13994?: Medium severity. CVSS v3 base score is 6.1 out of 10.