CVE-2020-27262

Published: Jan 8, 2021Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web interface.

Affected (1)

Products: Innokasmedical: Vital Signs Monitor Vc150 Firmware

1 product

Vital Signs Monitor Vc150 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Innokasmedical Vital Signs Monitor Vc150 Firmware	Before 1.7.15

Running on/with	Platform Versions
Innokasmedical Vital Signs Monitor Vc150	All versions

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsma-21-007-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.