Kelio Visio Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Kelio Visio 1, Kelio Visio X7, and Kelio Visio X4, affecting versions 3.2C through 5.1K. This vulnerability allows an attacker to execute a JavaScript payload by making a POST request and injecting malicious code into the editable 'username' parameter of the '/PageLoginVisio.do' endpoint.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious JavaScript in the context of the user's browser.

Remediation

The vulnerability has been fixed in Kelio Visio versions 4.5E11, 4.6K5, and 5.1L8.