Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1…
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other versions before 2.2.3.18 for M10/D10 and 3.0.3.31 for M22, allow remote attackers to inject arbitrary web script or HTML via URL-encoded values in (1) the query string to help/help, (2) the get_image_info_abspath parameter to control/eventplayer, and (3) the source_ip parameter to events.tar.
Why it matters now
EPSS 0.02952 87th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mobotix:mobotix_ip_network_camera:d10:*:*:*:*:*:*:* | d10 | Vulnerable | Mobotix |
| cpe:2.3:a:mobotix:mobotix_ip_network_camera:m1_1.9.4.7:*:*:*:*:*:*:* | m1_1.9.4.7 | Vulnerable | Mobotix |
| cpe:2.3:a:mobotix:mobotix_ip_network_camera:m10_2.0.5.2:*:*:*:*:*:*:* | m10_2.0.5.2 | Vulnerable | Mobotix |
| cpe:2.3:a:mobotix:mobotix_ip_network_camera:m22:*:*:*:*:*:*:* | m22 | Vulnerable | Mobotix |
- cpe:2.3:a:mobotix:mobotix_ip_network_camera:d10:*:*:*:*:*:*:* Versions d10 Vulnerable ·Mobotix
- cpe:2.3:a:mobotix:mobotix_ip_network_camera:m1_1.9.4.7:*:*:*:*:*:*:* Versions m1_1.9.4.7 Vulnerable ·Mobotix
- cpe:2.3:a:mobotix:mobotix_ip_network_camera:m10_2.0.5.2:*:*:*:*:*:*:* Versions m10_2.0.5.2 Vulnerable ·Mobotix
- cpe:2.3:a:mobotix:mobotix_ip_network_camera:m22:*:*:*:*:*:*:* Versions m22 Vulnerable ·Mobotix
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-2490
- 2026-10-03 Alias added: GHSA-598w-rp37-8cpg
References
Sources
- CVE-2006-2490 · CVE Program
- CVE-2006-2490 · NVD
- FIRST EPSS
- GHSA-598w-rp37-8cpg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences