What is CVE-2017-16567?

CVE-2017-16567 is a medium-severity vulnerability in Logitech Media Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2017-11-10.

How severe is CVE-2017-16567?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2017-16567 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Logitech Media Server

CVE-2017-16567

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Logitech Media_server — versions 7.9.0
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

dewankpant/CVE-2017-16567

References

cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, exploit)

Frequently asked questions

What is CVE-2017-16567?: CVE-2017-16567 is a medium-severity vulnerability in Logitech Media Server, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2017-11-10.
How severe is CVE-2017-16567?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2017-16567 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.