Web Based Management vulnerabilities

Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.

An XSS vulnerability in pxc_portSfp.php allows an unauthenticated remote attacker to trick an authenticated user into clicking a crafted link to change parameters available via web-based management (WBM). The flaw does not grant access to system-level resources, and the session cookie is protected by the httpOnly flag.

An XSS vulnerability in pxc_portCntr.php allows an unauthenticated remote attacker to trick an authenticated user into clicking a crafted link to change parameters available via web-based management (WBM). The flaw does not grant access to system-level resources, and the session cookie is protected by the httpOnly flag.

An XSS vulnerability in pxc_PortCfg.php allows an unauthenticated remote attacker to trick an authenticated user into clicking a crafted link to change parameters available via web-based management (WBM). The flaw does not grant access to system-level resources, and the session cookie is protected by the httpOnly flag.

An XSS vulnerability in pxc_Dot1xCfg.php allows an unauthenticated remote attacker to trick an authenticated user into clicking a crafted link to change parameters available via web-based management (WBM). The flaw does not grant access to system-level resources, and the session cookie is protected by the httpOnly flag.

An XSS vulnerability in pxc_vlanIntfCfg.php allows an unauthenticated remote attacker to trick an authenticated user into sending a manipulated POST request to the device to change parameters available via web-based management (WBM). The flaw does not grant access to system-level resources, and the session cookie is protected by the httpOnly flag.

An XSS vulnerability in pxc_portSecCfg.php allows an unauthenticated remote attacker to trick an authenticated user into sending a manipulated POST request to the device to change parameters available via web-based management (WBM). The flaw does not grant access to system-level resources, and the session cookie is protected by the httpOnly flag.