title: Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250
description: A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an
authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: mbNET
vendor: Red Lion Europe
versions:
lessThan: 7.3.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: mbNET.rokey
vendor: Red Lion Europe
versions:
lessThan: 7.3.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: REX 200
vendor: Helmholz
versions:
lessThan: 7.3.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: REX 250
vendor: Helmholz
versions:
lessThan: 7.3.2, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL