CVE-2021-32302
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in the IRZ Electronics RUH2 GSM router allows an attacker to inject malicious script via the Upload File parameter. This can lead to theft of sensitive information such as session data or cookies.
Risk Assessment
The risk involves potential session hijacking of an administrator or user, which could result in unauthorized access to the router and network configuration. The attacker may also steal credentials or other sensitive information.
Recommendation
Immediately update the IRZ Electronics RUH2 router firmware to the latest version that fixes this vulnerability. Additionally, validate and sanitize all input data, especially the Upload File parameter.
Original NVD description (English source)
Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter.