CVE-2018-5304
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Impinj Speedway Connect R420 RFID Reader是美国Impinj公司的一款用来识别和跟踪物体的识别器。 Impinj Speedway Connect R420 RFID Reader 2.2.2之前版本中的Web界面存在安全漏洞。攻击者可利用该漏洞将用户重定向到第三方应用程序或执行其他恶意操作。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-5304
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or perform other malicious actions.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Impinj Speedway Connect R420 RFID Reader 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Impinj Speedway Connect R420 RFID Reader是美国Impinj公司的一款用来识别和跟踪物体的识别器。 Impinj Speedway Connect R420 RFID Reader 2.2.2之前版本中的Web界面存在安全漏洞。攻击者可利用该漏洞将用户重定向到第三方应用程序或执行其他恶意操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2018-5304
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-5304
请登录查看更多情报信息。
Security Blog Posts for CVE-2018-5304 (1)
Same Patch Batch · n/a · 2018-05-11 · 16 CVEs total
| CVE-2018-10992 | LilyPond lilypond-invoke-editor 参数注入漏洞 | |
| CVE-2018-10832 | ModbusPal 安全漏洞 | |
| CVE-2018-5303 | Impinj Speedway Connect R420 RFID Reader 跨站脚本漏洞 | |
| CVE-2018-6023 | Fastweb FASTgate 跨站请求伪造漏洞 | |
| CVE-2018-6361 | Easy Hosting Control Panel 跨站脚本漏洞 | |
| CVE-2018-6362 | Easy Hosting Control Panel 跨站脚本漏洞 | |
| CVE-2018-6458 | Easy Hosting Control Panel 跨站请求伪造漏洞 | |
| CVE-2018-6617 | Easy Hosting Control Panel 安全漏洞 | |
| CVE-2018-6618 | Easy Hosting Control Panel 安全漏洞 | |
| CVE-2018-6619 | Easy Hosting Control Panel 安全漏洞 | |
| CVE-2009-5150 | Absolute Computrace Agent 安全漏洞 | |
| CVE-2009-5151 | Absolute Computrace Agent stub组件安全漏洞 | |
| CVE-2009-5152 | Dell Inspiron systems Absolute Computrace Agent 竞争条件漏洞 | |
| CVE-2018-10580 | MyBB Latest Posts on Profile插件跨站脚本漏洞 | |
| CVE-2018-7248 | ZOHO ManageEngine ServiceDesk Plus 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2018-5304
No comments yet