Read the docs
TI-2021-22472 Aliases CVE-2021-47858GHSA-66q7-gph7-j8gc

Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting

Priority MEDIUM 62CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface. Attackers can inject malicious scripts through the start source address field that will persist and trigger for privileged users when they access the security management page.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00283 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GenexisPlatinum-4410Firmware 1.31A—No fix listedCNA
  • Platinum-4410 VendorGenexis Affected Firmware 1.31A Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47858
  2. 2026-10-03 Alias added: GHSA-66q7-gph7-j8gc

References

Exploit 1

Other 1

  • TI-2021-09908 Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute… CVSS 3.1CRITICAL 9.8
  • TI-2024-05897 Genexis Tilgin Fiber Home Gateway HG1522 cross site scripting CVSS 4.0MEDIUM 6.9
  • TI-2020-05032 An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28… CVSS 3.1CRITICAL 9.8
  • TI-2017-03992 CPEs used by subscribers on the access network receive their individual configuration… CVSS 3.0CRITICAL 9.8
  • TI-2025-40496 A vulnerability has been identified in Genexis Platinum P4410 router (Firmware… CVSS 3.1HIGH 8.4
  • TI-2020-15889 UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H)… CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences