CVE-2014-7277 describes a cross-site scripting (XSS) vulnerability in the login page of the ZyXEL SBG-3300 Security Gateway, specifically in firmware versions 1.00(AADY.4)C0 and earlier. This flaw allows remote attackers to inject arbitrary web script or HTML through improperly handled "welcome message" form data. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and requiring no authentication, leading to a potential impact of partial integrity compromise. While it has a low EPSS score and FAUCET Risk Score, it could still allow for client-side attacks. There is no evidence of active exploitation, nor is there any publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also minimal, suggesting a low level of attention to this particular CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.00\(aady.4\)c0CPE matchmatch criteria | cpe:2.3:o:zyxel:sbg3300-n_firmware:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:h:zyxel:sbg3300-n:-:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.