CVE-2023-5880

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5880
When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users' web browser. 

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ Mitigation Vendor Advisory
https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:42

Type Values Removed Values Added
References () https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ - Mitigation, Vendor Advisory () https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ - Mitigation, Vendor Advisory

27 Aug 2024, 16:35

Type Values Removed Values Added
References () https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ - Mitigation, Vendor Advisory () https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ - Mitigation, Vendor Advisory

11 Jan 2024, 18:26

Type Values Removed Values Added
First Time Geniecompany
Geniecompany aladdin Connect Garage Door Opener Firmware
Geniecompany aladdin Connect Garage Door Opener
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:*:*:*:*:*:*:*
cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware:*:*:*:*:*:*:*:*
References () https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ - () https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/ - Mitigation, Vendor Advisory
Summary
  • (es) Cuando The Genie Company Aladdin Connect garage door opener(modelo ALDCM del kit de actualización) se coloca en modo de configuración, la página "Garage Door Control Module Setup" del servidor web es vulnerable a XSS a través de un nombre SSID de transmisión que contiene código malicioso con Java Script del lado del cliente y /o HTML. Esto permite al atacante inyectar código malicioso con Java Script y/o HTML del lado del cliente en el navegador web de los usuarios.

03 Jan 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-03 20:15

Updated : 2024-11-21 08:42

NVD link : CVE-2023-5880

Mitre link : CVE-2023-5880

CVE.ORG link : CVE-2023-5880

JSON object : View

Products Affected

geniecompany

  • aladdin_connect_garage_door_opener
  • aladdin_connect_garage_door_opener_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')