CVE-2024-3141

Clavister E10/E80 Misc Settings Page MiscSettings cross site scripting

State: Published
Severity: 2.4 Low
Published: Apr 1, 2024
Updated: Mar 12, 2025
Reserved: Apr 1, 2024

Description

A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This vulnerability affects unknown code of the file /?Page=Node&OBJ=/System/AdvancedSettings/DeviceSettings/MiscSettings of the component Misc Settings Page. The manipulation of the argument WatchdogTimerTime/BufFloodRebootTime/MaxPipeUsers/AVCache Lifetime/HTTPipeliningMaxReq/Reassembly MaxConnections/Reassembly MaxProcessingMem/ScrSaveTime leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258916.

Scores

CVSS	Score	Vector	Source
3.1	2.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	2.4 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting

Affected Products

Product	Versions
E10Clavister	14.00.0Affected 14.00.1Affected 14.00.2Affected 14.00.3Affected 14.00.4Affected 14.00.5Affected 14.00.6Affected 14.00.7Affected 14.00.8Affected 14.00.9Affected 14.00.10Affected
E80Clavister	14.00.0Affected 14.00.1Affected 14.00.2Affected 14.00.3Affected 14.00.4Affected 14.00.5Affected 14.00.6Affected 14.00.7Affected 14.00.8Affected 14.00.9Affected 14.00.10Affected

References

VDB-258916 | Clavister E10/E80 Misc Settings Page MiscSettings cross site scriptingvdb-entrytechnical-description
VDB-258916 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #303451 | Clavister Clavister E80 - EagleSeries . Cross-Site Scriptingthird-party-advisory
https://github.com/strik3r0x1/Vulns/blob/main/Clavister_E80-RXSS.mdexploit
https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260related
https://my.clavister.com/downloads/?sid=1patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.