XSS in Meikyo Poe Boot Nino Poe8m2
CVE-2022-28717
Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker with the administrative privilege to inject an arbitrary script via unspecified vectors.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (43.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Meikyo Poe_boot_nino_poe8m2
- Meikyo Poe_boot_nino_poe8m2_firmware
- Meikyo Pose_se10-8a7b1
- Meikyo Pose_se10-8a7b1_firmware
- Meikyo Signage_rebooter_rpc-m4hsi
- Meikyo Signage_rebooter_rpc-m4hsi_firmware — versions 1.00a
- Meikyo Time_boot_mini_rsc-mt4h
- Meikyo Time_boot_mini_rsc-mt4h_firmware
- Meikyo Time_boot_mini_rsc-mt4hs
- Meikyo Time_boot_mini_rsc-mt4hs_firmware
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Patch, x_refsource_MISC, Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-28717?
- CVE-2022-28717 is a medium-severity vulnerability in Meikyo Poe Boot Nino Poe8m2, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2022-05-18.
- How severe is CVE-2022-28717?
- Medium severity. CVSS v3 base score is 4.8 out of 10.