CVE-2018-5304 describes a ClickJacking vulnerability affecting the web interface of Impinj Speedway Connect R420 RFID Readers prior to version 2.2.2. An attacker could embed the reader's web interface within an iframe, potentially redirecting users to malicious sites or performing unauthorized actions upon interaction. Rated Medium severity with a CVSS score of 4.3, this vulnerability requires user interaction (UI:R) and has a low impact on integrity (I:L), meaning it could lead to unauthorized data modification but not necessarily data disclosure or system unavailability. The attack complexity is low (AC:L) and it can be exploited over the network (AV:N). There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, or entries in ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.2.2CPE matchmatch criteria | cpe:2.3:o:impinj:r420_rfid_reader_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.