CVE-2023-2587

Published: May 22, 2023Modified: Jun 17, 2026

8.3

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 6.0

Source: NVD

Description

Teltonika’s Remote Management System versions prior to 4.10.0 contain a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices.

Affected (1)

Products: Teltonika: Remote Management System

1 product

Remote Management System

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Teltonika Remote Management System	Before 4.10.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.