Omnidirectional Communication System CVEs and Security Vulnerabilities

CVE-2021-30173

Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion

Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Junhetec

Products

Omnidirectional Communication System

CVE-2021-30172

Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed