CVE-2023-2587
High
Description
Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices.
SeverityHigh
CVSS7.5
Exploit probability—
ProductTeltonika Remote Management System
PublishedMay 22, 2023
First seenMay 22, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- teltonika remote_management_system4.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| teltonika remote_management_system | v < 4.10.0 | 4.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.