D-Link DGS-3420 Cross-Site Scripting Vulnerability in System Information Settings Page

A cross-site scripting (XSS) vulnerability has been identified in the D-Link DGS-3420 switch, specifically in version 1.50.018. The issue arises within the System Information Settings Page, where the System Name field can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the D-Link DGS-3420 switch's management interface and navigate to the System Information Settings Page. In the System Name field, inject a script payload, such as an image tag with an onerror event, which will trigger a prompt when the image fails to load.