Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Billion SG600R2 router firmware lets attackers run code

CVE-2019-14918 · published 6 years ago
Summary

The firmware on the Billion SG600R2 router can be tricked into inserting malicious web code when it displays the DHCP lease-status table. An attacker who can send specially crafted network requests could make the router’s web interface run that code in a user’s browser, potentially stealing data or taking actions on the user’s behalf. Update the router firmware to the latest version or apply the vendor’s patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
billion sg600_r2_firmware 3.02
cpe:2.3:o:billion:sg600_r2_firmware:3.02:rc6:*:*:*:*:*:*
Original advisory text
XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via cr...
XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Jan 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-14918 · NVD
Track software like this
Free during beta