KeeneticOS Cross-Site Scripting Vulnerability on the Wireless ISP Page

A cross-site scripting (XSS) vulnerability exists in KeeneticOS versions prior to 4.3, specifically on the Wireless ISP configuration page. This vulnerability allows attackers in close proximity to the router to execute malicious scripts by broadcasting a specially crafted SSID. When the script is executed, it can take over the device by adding new users with full permissions.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute scripts in the context of the user's session, potentially leading to unauthorized control of the device.

Remediation

Users are advised to upgrade to KeeneticOS 4.3, which addresses this vulnerability. Firmware updates can be done through the device's web interface or the Keenetic mobile app.