Loytec Lvis-3me Firmware vulnerabilities

4 CVEs affecting Loytec Lvis-3me Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-13998, published 2017-10-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-13992, published 2017-10-05. High severity, CVSS 8.1. EPSS: 3.5% chance of exploitation in the next 30 days. An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication…
CVE-2017-13996, published 2017-10-05. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not…
CVE-2017-13998, published 2017-10-05. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access.
CVE-2017-13994, published 2017-10-05. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an…