CVE-2013-6786 - CVE House
Back to Database
Status published Medium CVE-2013-6786

Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as...

Vulnerability Description

Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-6786

Credits & Attribution

No credits recorded in the NVD database.

References

More from allegrosoft

View All →
CVE-2014-9223
Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei...
Critical 10
CVE-2014-9222
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home...
Critical 10

Affected Vendor

allegrosoft

View all reports →

Affected Software

rompager, dsl-2640r, dsl-2641r, mt882, wl-174, td-8816, p-660hw d1
Vulnerable Versions:
0

Timeline

Official Publish: January 16th, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.