CVE-2013-6786

Published: Jan 16, 2014Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.

Affected (7)

Products: Allegrosoft: Rompager · Dlink: Dsl 2640r, Dsl 2641r · Huawei: Mt882 · +3 more

Show all products

Allegrosoft: Rompager · Dlink: Dsl 2640r, Dsl 2641r · Huawei: Mt882 · Sitecom: Wl 174 · Tp Link: Td 8816 · Zyxel: P 660hw D1

1 product

2 products

1 product

1 product

1 product

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Allegrosoft Rompager	Up to 4.07
Dlink Dsl 2640r	All versions
Dlink Dsl 2641r	All versions
Huawei Mt882	All versions
Sitecom Wl 174	All versions
Tp Link Td 8816	All versions
Zyxel P 660hw D1	All versions