Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2022-38814: A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj...
CVE-2022-38814 · published 4 years ago
Summary
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fiberhome | an5506-02-b_firmware |
rp2521 cpe:2.3:o:fiberhome:an5506-02-b_firmware:rp2521:*:*:*:*:*:*:* |
Original advisory text
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj...
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
References
- https://packetstormsecurity.com/files/168065/Fiberhome-AN5506-02-B-Cross-Site-Sc... Exploit Third Party Advisory VDB Entry
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Sep 2022
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2022-38814 · NVD
Track software like this
Free during beta