CVE-2019-10677 — Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone Z
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscC
Published
2019-09-05T13:23:06.000Z
Last modified
2024-08-04T22:32:01.018Z
01What is this vulnerability?
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).
02Affected products
| Vendor | Product | Versions |
|---|
| n | a / n/a | n/a |
03Active exploitation status
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
04Recommended remediation
- Patch to a fixed version listed in the vendor advisory (see references below).
- Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
- Hunt historical logs for exploitation indicators — see Detection signatures below.
05Technical details
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
06Detection signatures
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
07Related CVEs
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.
08Timeline
- Published: 2019-09-05T13:23:06.000Z
- Last modified: 2024-08-04T22:32:01.018Z
09References
- adamziaja.com — https://adamziaja.com/poc/201903-xss-zhone.html
- redteam.pl — https://redteam.pl/poc/dasan-zhone-znid-gpon-2426a-eu.html
- packetstormsecurity.com — http://packetstormsecurity.com/files/154357/DASAN-Zhone-ZNID-GPON-2426A-EU-Cross…
- blog.redteam.pl — https://blog.redteam.pl/2019/09/cve-2019-10677-dasan-zhone-znid.html
Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →