« Volver al listado

CVE-2021-40517

Estado: ModificadaMedia (5.4)—

Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Airangel — Hsmx-app-1000 FirmwareAirangel — Hsmx-app-100 FirmwareAirangel — Hsmx-app-20000 FirmwareAirangel — Hsmx-app-25 FirmwareAirangel — Hsmx-app-5000 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-40517",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-10T17:15:10.913",
  "references": [
    {
      "url": "http://etizazmohsin.com/hsmx.html#xss",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://airangel.com/hsmx-gateway/",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://etizazmohsin.com/hsmx.html#xss",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://airangel.com/hsmx-gateway/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Airangel HSMX Gateway versiones hasta 5.2.04, son vulnerables a un ataque de tipo Cross Site Scripting almacenado. La carga útil de tipo XSS es colocada en la columna del nombre de la tabla de actualizaciones usando el acceso a la base de datos"
    }
  ],
  "lastModified": "2026-06-17T04:07:04.413",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:airangel:hsmx-app-25_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E95BDF79-C171-4D98-9CCD-5CA0F3A23C31",
              "versionEndIncluding": "5.2.04"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:airangel:hsmx-app-25:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DA4D9556-DCDB-45B2-92AC-FD5E18D52FCA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:airangel:hsmx-app-100_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90BA76CF-88CD-47BA-AEFB-F168E4FA5C69",
              "versionEndIncluding": "5.2.04"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:airangel:hsmx-app-100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E13C0E32-7B81-4428-BB5C-8C86A703A9BA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:airangel:hsmx-app-1000_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBEBEE86-0C31-4782-8D78-41B48C647FCF",
              "versionEndIncluding": "5.2.04"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:airangel:hsmx-app-1000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D92343DB-597C-43C4-A967-12AC27C9B0E1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:airangel:hsmx-app-5000_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31678F7E-F1FB-4801-BE44-5B7D7A6BB3A0",
              "versionEndIncluding": "5.2.04"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:airangel:hsmx-app-5000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "02BE8018-61F5-4482-8BCE-2F7F64C66FE5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:airangel:hsmx-app-20000_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8731061-B7E3-4010-8346-06951881F33D",
              "versionEndIncluding": "5.2.04"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:airangel:hsmx-app-20000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AF17EAEF-C272-45BB-AFBF-E0D247267D94"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}