CVE-2024-53563
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware allows attackers to inject malicious scripts that execute when users access affected pages. This affects users of Arcadyan Meteor 2 CPE FG360 devices running vulnerable firmware versions. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- Arcadyan Meteor 2 CPE FG360
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, credential theft, device compromise, and lateral movement within the network
Likely Case
Session hijacking, credential theft, and unauthorized actions performed as the victim user
If Mitigated
Limited impact due to proper input validation, output encoding, and Content Security Policy implementation
🎯 Exploit Status
Exploitation requires access to inject payloads into stored locations that are later rendered
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.arcadyan.com/en-us/solutions/idea/fiveG/
Restart Required: Yes
Instructions:
1. Check Arcadyan website for firmware updates
2. Download latest firmware
3. Backup current configuration
4. Upload and apply firmware update
5. Verify update completed successfully
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to HTTP headers
Input Validation Filtering
allFilter and sanitize all user inputs before storage
Implement HTML entity encoding for user inputs: & -> &, < -> <, > -> >, " -> ", ' -> '
🧯 If You Can't Patch
- Restrict access to web management interface using firewall rules
- Implement network segmentation to isolate vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface and compare against known vulnerable versionsCheck Version:
Login to web interface and navigate to System Status or About pageVerify Fix Applied:
Test XSS payload injection in previously vulnerable fields and verify proper sanitization📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with script tags or JavaScript payloads
- Multiple failed login attempts followed by successful login from different IP
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in parameters
- Unusual outbound connections from device to external servers
SIEM Query:
source="web_logs" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")