What is CVE-2018-12073?

CVE-2018-12073 is a medium-severity vulnerability in Eminent-Online Em4544, classified under Cross-site Scripting. CVSS score: 5.3/10. Published 2018-06-17.

How severe is CVE-2018-12073?

Medium severity. CVSS v3 base score is 5.3 out of 10.

XSS in Eminent-Online Em4544

CVE-2018-12073

An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue (e.g., in combination with a successful XSS, or at an unattended workstation) to change the admin password to an attacker-chosen value without knowing the current password.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (33.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Eminent-online Em4544 — versions 9.10
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-12073?: CVE-2018-12073 is a medium-severity vulnerability in Eminent-Online Em4544, classified under Cross-site Scripting. CVSS score: 5.3/10. Published 2018-06-17.
How severe is CVE-2018-12073?: Medium severity. CVSS v3 base score is 5.3 out of 10.