CVE-2023-24497: O Milesight

Medium severity, CVSS 4.7. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the remote_subnet field of the database

Affected products

• O Milesight: version milesightvpn only

Published 2023-07-06. Last modified 2026-06-17.