CVE-2024-26367

MediumCVSS 6.1

Published: 14/05/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.64%

46th percentile - higher than 46% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Evertz microsystems MViP-II Firmware 8.6.5 and other products (XPS-EDGE-*, evEDGE-EO-*, MMA10G-*, 570IPG-X19-10G) allows a remote attacker to execute arbitrary code via a crafted payload in login parameters.

Risk Assessment

An attacker can hijack an administrator session, steal credentials, or inject malicious code, compromising the confidentiality and integrity of the infrastructure.

Recommendation

Immediately update the firmware to a patched version and implement input validation for login parameters.

Original NVD description (English source)

Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-* Build 1467, evEDGE-EO-* Build 0029, MMA10G-* Build 0498, 570IPG-X19-10G Build 0691 allows a remote attacker to execute arbitrary code via a crafted payload to the login parameters.