CVE-2020-21733

MediumCVSS 6.1

Published: 14/09/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.72%

50th percentile - higher than 50% of all known CVEs

Summary

The Sagemcom F@ST3686 device with firmware version 1.0 HUN 3.97.0 is vulnerable to Cross-Site Scripting (XSS) attacks. The vulnerability exists in several ASP scripts: RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, and RgVpnL2tpPptp.asp.

Risk Assessment

An attacker can inject malicious JavaScript code into administrative pages, potentially leading to session theft, device takeover, or further attacks within the local network.

Recommendation

Immediately update the firmware of the Sagemcom F@ST3686 device to the latest available version. If no update is available, restrict administrative panel access to trusted IP addresses only.

Original NVD description (English source)

Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.