[EndRun] - NTP servers - Nonauthenticated XSS Reflected [ CVE-2023-38967 ]

 

EndRun Technologies is dedicated to the development and refinement of the technologies required to fulfill the demanding needs of the time and frequency community.

--------------------------------------------------------------------------------------------------------------------------

EndRun NTP servers present vulnerabilities that allow an unauthenticated attacker to inject malicious javascript code (Cross-site Scripting - XSS).

Requirements:

- Authenticated

- HTTPS

- Accessible from the internet

Affected Devices:

•   Tempus LX CDMA Network Time Server
•   Sonoma Network Time Server GPS-Synchronized
•   RTM3205 Precision Timing Module
•   Meridian II 2U Precision TimeBase
•   Unison CDME NEtwork Time Server

Affected Components:

•   ftp_linux_wait.php - Parameter [ login_name ]
•   reboot.php - Parameters [user & pass ]

ftp_linux_wait.php

reboot.php

CVE: CVE-2023-38967

By: @Linuxmonr4