CVE-2021-31655

MediumCVSS 6.1

Published: 10/08/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.74%

50th percentile - higher than 50% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability was found in TRENDnet TV-IP110WN cameras running firmware versions V1.2.2.64, V1.2.2.65, and V1.2.2.68. The flaw exists in the 'profile' parameter of a GET request to view.cgi.

Risk Assessment

An attacker can inject malicious JavaScript code into the camera's login or admin panel, potentially leading to session theft, admin account takeover, or redirection to a malicious site.

Recommendation

Immediately update the TRENDnet TV-IP110WN firmware to the latest available version that fixes this vulnerability. If no update is available, restrict access to the camera's management interface to trusted networks only.

Original NVD description (English source)

Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. in a GET request in view.cgi.