Paper/Archive/CVE-2024-23786

CVE-2024-23786

SHARP CORPORATION Energy Management Controller with Cloud Services — Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a…

EPSS 0.8%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (ADP, NVD agree)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 56.1.561 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product.

Affected

ProductAffectedFixed inSource

Energy Management Controller with Cloud ServicesJH-RVB1 Ver.B0.1.9.1 and earlier–CNA

Energy Management Controller with Cloud ServicesJH-RV11 Ver.B0.1.9.1 and earlier–CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjp.sharp/support/taiyo/info/JVNVU94591337_en.pdf refjp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf refjvn.jp/en/vu/JVNVU94591337