{"id":"CVE-2022-45938","aliases":["EUVD-2022-48780","GHSA-rjjp-36rj-xc8p"],"status":"published","title":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can...","description":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.45078,"percentile":0.98792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-06-02T00:00:00Z","modified":"2026-06-17T05:11:03Z","products":[{"vendor":"xfinity","product":"comcast_defined_technologies_microeisbss"}],"references":[{"url":"https://my.xfinity.com/vulnerabilityreport","tags":["x_transferred","Not Applicable"]},{"url":"https://pensecure.medium.com/cve-2022-45938-f4c0d441da6f","tags":["x_transferred","Exploit","Press/Media Coverage"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45938"},{"url":"https://github.com/advisories/GHSA-rjjp-36rj-xc8p"}],"sources":{"cve":[{"id":"CVE-2022-45938","description":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..","status":"published","published":"2023-06-02T00:00:00Z","modified":"2025-01-10T18:26:04.977Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-48780","description":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..","status":"published","published":"2023-06-02T00:00:00Z","modified":"2025-01-10T18:26:04Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:21.239531Z"}],"ghsa":[{"id":"GHSA-rjjp-36rj-xc8p","title":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can...","description":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..","status":"published","published":"2023-06-02T06:30:35Z","modified":"2024-04-04T04:28:14Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:24.450325Z"}],"nvd":[{"id":"CVE-2022-45938","description":"An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..","status":"published","published":"2023-06-02T04:15:47.943Z","modified":"2026-06-17T05:11:03.557Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:38.721429Z"}]}}