CVE-2023-36386

Summary

CVE-2023-36386 is a reflected cross-site scripting (XSS) vulnerability affecting multiple RUGGEDCOM ROX models, including MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000, all running versions earlier than V2.16.0. The flaw lies in the web interface, where user input is not sanitized before being reflected in the response. This opens the door for attackers to inject malicious JavaScript code by luring users into visiting a malicious link. The error message "invalid params element name" appears upon receiving such malicious input on the get_elements parameters.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.