CVE-2022-35612: n/a in n/a
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
AI Analysis
Technical Summary
CVE-2022-35612 is a medium-severity cross-site scripting (XSS) vulnerability affecting MQTTRoute versions 3.3 and below. The vulnerability arises from improper sanitization of user input in the dashboard name text field, allowing an attacker to inject crafted payloads containing arbitrary web scripts or HTML. When such a payload is rendered in the dashboard interface, it can execute in the context of the victim's browser session. This type of vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation. The CVSS 3.1 base score is 5.4, reflecting a network attack vector (AV:N), low attack complexity (AC:L), requiring privileges (PR:L) and user interaction (UI:R), with a scope change (S:C) and limited impact on confidentiality and integrity (C:L/I:L) but no impact on availability (A:N). Exploiting this vulnerability could allow an attacker to steal session tokens, perform actions on behalf of the user, or manipulate the dashboard interface, potentially leading to further compromise within the affected environment. No known exploits are currently reported in the wild, and no official patches or vendor information are provided in the available data.
Potential Impact
For European organizations using MQTTRoute v3.3 or earlier, this vulnerability poses a risk primarily to the confidentiality and integrity of their dashboard sessions. Since MQTTRoute is a tool used for managing MQTT message routing, organizations relying on it for IoT or messaging infrastructure could face risks of session hijacking or unauthorized command execution within the dashboard interface. This could lead to unauthorized access to sensitive operational data or manipulation of message routing configurations. The requirement for low privileges and user interaction means that insider threats or targeted phishing attacks could exploit this vulnerability. While the availability of systems is not directly impacted, the potential for unauthorized access and data leakage could have regulatory and operational consequences under European data protection laws such as GDPR. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially in environments with less stringent input validation or monitoring.
Mitigation Recommendations
To mitigate this vulnerability, European organizations should implement strict input validation and output encoding on the dashboard name text field to neutralize any injected scripts or HTML. Since no official patches are currently available, organizations should consider applying web application firewalls (WAFs) with custom rules to detect and block suspicious payloads targeting the dashboard input fields. Restricting dashboard access to trusted users and enforcing multi-factor authentication can reduce the risk of exploitation. Additionally, organizations should conduct security awareness training to prevent social engineering attacks that could lead to user interaction exploitation. Monitoring logs for unusual dashboard activity and anomalous input patterns can help detect attempted exploitation. If feasible, upgrading to a version of MQTTRoute that addresses this vulnerability or switching to alternative MQTT routing solutions with better security practices is recommended once patches become available.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain, Sweden
CVE-2022-35612: n/a in n/a
Description
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
AI-Powered Analysis
Technical Analysis
CVE-2022-35612 is a medium-severity cross-site scripting (XSS) vulnerability affecting MQTTRoute versions 3.3 and below. The vulnerability arises from improper sanitization of user input in the dashboard name text field, allowing an attacker to inject crafted payloads containing arbitrary web scripts or HTML. When such a payload is rendered in the dashboard interface, it can execute in the context of the victim's browser session. This type of vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation. The CVSS 3.1 base score is 5.4, reflecting a network attack vector (AV:N), low attack complexity (AC:L), requiring privileges (PR:L) and user interaction (UI:R), with a scope change (S:C) and limited impact on confidentiality and integrity (C:L/I:L) but no impact on availability (A:N). Exploiting this vulnerability could allow an attacker to steal session tokens, perform actions on behalf of the user, or manipulate the dashboard interface, potentially leading to further compromise within the affected environment. No known exploits are currently reported in the wild, and no official patches or vendor information are provided in the available data.
Potential Impact
For European organizations using MQTTRoute v3.3 or earlier, this vulnerability poses a risk primarily to the confidentiality and integrity of their dashboard sessions. Since MQTTRoute is a tool used for managing MQTT message routing, organizations relying on it for IoT or messaging infrastructure could face risks of session hijacking or unauthorized command execution within the dashboard interface. This could lead to unauthorized access to sensitive operational data or manipulation of message routing configurations. The requirement for low privileges and user interaction means that insider threats or targeted phishing attacks could exploit this vulnerability. While the availability of systems is not directly impacted, the potential for unauthorized access and data leakage could have regulatory and operational consequences under European data protection laws such as GDPR. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially in environments with less stringent input validation or monitoring.
Mitigation Recommendations
To mitigate this vulnerability, European organizations should implement strict input validation and output encoding on the dashboard name text field to neutralize any injected scripts or HTML. Since no official patches are currently available, organizations should consider applying web application firewalls (WAFs) with custom rules to detect and block suspicious payloads targeting the dashboard input fields. Restricting dashboard access to trusted users and enforcing multi-factor authentication can reduce the risk of exploitation. Additionally, organizations should conduct security awareness training to prevent social engineering attacks that could lead to user interaction exploitation. Monitoring logs for unusual dashboard activity and anomalous input patterns can help detect attempted exploitation. If feasible, upgrading to a version of MQTTRoute that addresses this vulnerability or switching to alternative MQTT routing solutions with better security practices is recommended once patches become available.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2022-07-11T00:00:00.000Z
- Cisa Enriched
- true
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 682cd0fb1484d88663aec5a2
Added to database: 5/20/2025, 6:59:07 PM
Last enriched: 7/6/2025, 9:56:47 AM
Last updated: 8/12/2025, 7:38:32 PM
Views: 10
Related Threats
CVE-2025-9096: Cross Site Scripting in ExpressGateway express-gateway
MediumCVE-2025-9095: Cross Site Scripting in ExpressGateway express-gateway
MediumCVE-2025-7342: CWE-798 Use of Hard-coded Credentials in Kubernetes Image Builder
HighCVE-2025-9094: Improper Neutralization of Special Elements Used in a Template Engine in ThingsBoard
MediumCVE-2025-9093: Improper Export of Android Application Components in BuzzFeed App
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.