CVE-2024-38308

Advantech ADAM-5550 Cross-site Scripting

State: Published
Severity: 8.7 High
Published: Sep 27, 2024
Updated: Sep 27, 2024
Reserved: Jun 26, 2024

Description

Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neutralize malicious code when parsing HTTP requests to generate page output.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	icscert
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-79 Cross-site Scripting

Affected Products

Product	Versions
ADAM 5550Advantech	all versionsAffected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.