« Volver al listado

CVE-2024-28089

Estado: AplazadaMedia (5.2)—

Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel) to conduct a DOM-based stored XSS attack that can fetch remote resources. The payload is executed at index.html#advanced_location (aka the Device Location page). This can cause a denial of service or lead to information disclosure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Hitron — Coda-4582AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28089",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28089",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-12T17:37:53.476048Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:hitrontech:coda-4582u_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "hitrontech",
          "product": "coda-4582u_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.4.5.1b8"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:hitrontech:coda-4589_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "hitrontech",
          "product": "coda-4589_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.4.5.1b8"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-09T07:15:09.577",
  "references": [
    {
      "url": "https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-28089",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/actuator/cve/blob/main/Hitron/Hitron_DOM_XSS_POC.gif",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/actuator/cve/blob/main/Hitron/Hitron_DOM_XSS_POC_DOS_ALT.gif",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-28089",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/actuator/cve/blob/main/Hitron/Hitron_DOM_XSS_POC.gif",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/actuator/cve/blob/main/Hitron/Hitron_DOM_XSS_POC_DOS_ALT.gif",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel) to conduct a DOM-based stored XSS attack that can fetch remote resources. The payload is executed at index.html#advanced_location (aka the Device Location page). This can cause a denial of service or lead to information disclosure."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 permiten a un atacante remoto dentro de la proximidad de Wi-Fi (que tiene acceso al panel de administración del router) realizar un ataque XSS almacenado basado en DOM que puede recuperar recursos remotos. El payload se ejecuta en index.html#advanced_location (también conocida como la página Ubicación del dispositivo). Esto puede provocar una denegación de servicio o dar lugar a la divulgación de información."
    }
  ],
  "lastModified": "2026-06-17T07:20:56.667",
  "sourceIdentifier": "cve@mitre.org"
}