CVE-2023-24496

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
Milesight	MilesightVPN	v2.0.2

References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1704Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1704

Timeline

Published: Jul 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-244974.7Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-CVE-2023-244987.5An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config CVE-2023-244994.6Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spo CVE-2023-24504.4The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version CVE-2023-245006.5Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.CVE-2023-245019.8Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit.CVE-2023-245026.5Electra Central AC unit – The unit opens an AP with an easily calculated password.CVE-2023-245036.5Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.CVE-2023-245046.5Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server.CVE-2023-245057.5Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.CVE-2023-245067.5Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.CVE-2023-245079.8AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request.