Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast.

Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast.

Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast. Intelbras NPLUG Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. IntelbrasNPLUG is a wireless relay device from Intelbras, Poland. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML with a specially crafted SSID. =====[ Tempest Security Intelligence ]=====================================

Multiple vulnerabilities in NPLUG wireless repeater

CVE-2018-12455: Authentication bypass CVE-2018-12456: Multiple CSRF CVE-2018-17337: XSS via SSID

------------------------------------------------------- Author: - Patrick Costa < @patrickrbc > Tempest Security Intelligence - Recife, PE - Brazil

=====[ Table of Contents ]=================================================

1. Overview 2. Detailed description 3. Affected versions & Solutions 4. Timeline of disclosure 5. Thanks & Acknowledgements 6. References

=====[ Overview ]========================================================== * System affected : NPLUG wireless repeater [1] * Version : 1.0.0.14 * Impact : An attacker can get root access on the device.

=====[ Detailed description ]==============================================

DISCLAIMER: This device uses a modified Tenda firmware [2]. Most of the vulnerabilities disclosed here were previously published regarding other…