CVE-2023-24496 - CVE House
Back to Database
Status published Medium CVE-2023-24496

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality...

Vulnerability Description

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24496

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Discovered by Francesco Benvenuto of Cisco Talos.

References

More from Milesight

View All →
CVE-2025-4043
Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code
Medium 6.1
CVE-2023-47166
A firmware update vulnerability exists in the luci2-io file-import functionality...
High 8.8
CVE-2023-32220
Milesight NCR/Camera Authentication Bypass
High 8.2
CVE-2023-30467
Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)
High 7.5
CVE-2023-30466
Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)
Critical 9.8

Affected Vendor

Affected Software

MilesightVPN
Vulnerable Versions:
v2.0.2

Timeline

Official Publish: July 6th, 2023
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-80

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact