AudioCodes MP-202b Cross-Site Scripting Vulnerability Allowing Privilege Escalation

A cross-site scripting (XSS) vulnerability has been identified in the AudioCodes MP-202b device running version 4.4.3. This vulnerability allows remote attackers to escalate privileges by exploiting the login page of the web interface. The issue arises from reflected XSS, where an attacker can craft a URL that, when visited by a user, captures their login credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation on the affected device.

Reproduction

To reproduce this vulnerability, a user must be coerced into clicking a specially crafted URL that exploits the reflected XSS vulnerability on the login page. Once the user logs in, the crafted URL can capture their login details, potentially allowing an attacker to escalate privileges.