CVE-2015-6402 describes a Cross-Site Scripting (XSS) vulnerability in the management interface of Cisco EPC3928 devices running EDVA firmware versions 5.5.10, 5.5.11, and 5.7.1. This flaw allows remote, unauthenticated attackers to inject arbitrary web script or HTML through an unspecified input, impacting the integrity of the web interface. While the CVSS score is moderate at 4.3, indicating a medium attack complexity and partial integrity impact, its FAUCET Risk Score is high at 96/100, suggesting a significant potential risk. There is no evidence of active exploitation, and while an ExploitDB entry exists (EDB-39904) mentioning multiple vulnerabilities for this device, specific exploit code for this CVE is not publicly available via Metasploit or Nuclei, and there is no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.5.10CPE matchmatch criteria | cpe:2.3:o:cisco:epc3928_docsis_3.0_8x4_wireless_residential_gateway_with_embedded_digital_voice_adapter:5.5.10:*:*:*:*:*:*:* | ||
5.5.11CPE matchmatch criteria | cpe:2.3:o:cisco:epc3928_docsis_3.0_8x4_wireless_residential_gateway_with_embedded_digital_voice_adapter:5.5.11:*:*:*:*:*:*:* | ||
5.7.1CPE matchmatch criteria | cpe:2.3:o:cisco:epc3928_docsis_3.0_8x4_wireless_residential_gateway_with_embedded_digital_voice_adapter:5.7.1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.