CVE-2019-10677

Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).

• CWE-79

• http://packetstormsecurity.com/files/154357/DASAN-Zhone-ZNID-GPON-2426A-EU-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://adamziaja.com/poc/201903-xss-zhone.htmlExploit, Third Party Advisory
• https://blog.redteam.pl/2019/09/cve-2019-10677-dasan-zhone-znid.htmlExploit, Third Party Advisory
• https://redteam.pl/poc/dasan-zhone-znid-gpon-2426a-eu.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/154357/DASAN-Zhone-ZNID-GPON-2426A-EU-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://adamziaja.com/poc/201903-xss-zhone.htmlExploit, Third Party Advisory
• https://blog.redteam.pl/2019/09/cve-2019-10677-dasan-zhone-znid.htmlExploit, Third Party Advisory
• https://redteam.pl/poc/dasan-zhone-znid-gpon-2426a-eu.htmlExploit, Third Party Advisory

Published

Sep 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10670An issue was discovered in LibreNMS through 1.47. Many of th…6.1
• CVE-2019-10671An issue was discovered in LibreNMS through 1.47. It does no…8.8
• CVE-2019-10672treeRead in hdf/btree.c in libmysofa before 0.7 does not pro…
• CVE-2019-10673A CSRF vulnerability in a logged-in user's profile edit form…
• CVE-2019-10675Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-10676An issue was discovered in Uniqkey Password Manager 1.14. Up…
• CVE-2019-10678Domoticz before 4.10579 neglects to categorize \n and \r as …
• CVE-2019-10679Thomson Reuters Eikon 4.0.42144 allows all local users to mo…7.8
• CVE-2019-1068A remote code execution vulnerability exists in Microsoft SQ…
• CVE-2019-10682django-nopassword before 5.0.0 stores cleartext secrets in t…7.5
• CVE-2019-10684Application/Admin/Controller/ConfigController.class.php in 7…
• CVE-2019-10685A Reflected Cross Site Scripting (XSS) Vulnerability was dis…