Secunia

Preben Nyløkken has reported a vulnerability in Thomson SpeedTouch 500 Series, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "name" parameter in the LocalNetwork page isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Example:
http://[host]/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code]

The vulnerability has been reported in firmware version 5.3.2.6.0. Other versions may also be affected

Note: It is reportedly possible for the administrative user to create new users with Javascript in their user names, which cannot be deleted. This can also be performed via the telnet interface without authentication.

Solution
Filter malicious characters and character sequences in a proxy or firewall with URL filtering capabilities.

Provided and/or discovered by
Preben Nyløkken

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area