CVE-2020-26733

Published: Jan 14, 2021Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section.

Affected (1)

Products: Skyworth: Gn542vf Firmware

Skyworth

1 product

Gn542vf Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Skyworth Gn542vf Firmware	Version 2.0.0.16

Running on/with	Platform Versions
Skyworth Gn542vf	Version 2.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/swzhouu/CVE-2020-26733

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/swzhouu/CVE-2020-26733

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.