CVE-2023-24497 is a cross-site scripting (XSS) vulnerability classified under CWE-80 that affects MilesightVPN version 2.0.2. The vulnerability arises from improper neutralization of script-related HTML tags within the detail_device functionality of the requestHandlers.js component. Specifically, the remote_subnet field in the database is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code through a crafted HTTP request. This injected script can execute in the context of the victim's browser when they access the vulnerable interface, potentially leading to session hijacking, credential theft, or other malicious actions that compromise confidentiality and integrity. The vulnerability requires user interaction (e.g., the victim visiting a maliciously crafted page or interface) and does not require authentication, increasing its risk profile. The CVSS v3.1 score is 4.7 (medium), reflecting network attack vector, high attack complexity, no privileges required, and user interaction needed. No known exploits have been reported in the wild as of the publication date. The vulnerability's scope is limited to the MilesightVPN management interface, and it does not affect availability. The flaw highlights the importance of proper input validation and output encoding in web applications, especially those managing critical network infrastructure such as VPNs.

For European organizations, this vulnerability could lead to unauthorized execution of malicious scripts within the context of the MilesightVPN web interface. This can result in session hijacking, theft of administrative credentials, or manipulation of VPN configurations, undermining the confidentiality and integrity of secure communications. Organizations relying on MilesightVPN for remote access or site-to-site VPNs may face increased risk of lateral movement by attackers if this vulnerability is exploited. Although no availability impact is noted, the compromise of VPN management could indirectly lead to service disruptions or unauthorized access to internal networks. The medium severity suggests a moderate risk, but the lack of authentication requirements and the potential for user interaction-based exploitation make it a relevant threat, especially in environments where multiple administrators access the VPN interface. European sectors such as finance, healthcare, and critical infrastructure that depend on secure VPN connections could be particularly impacted if attackers leverage this vulnerability to gain footholds or exfiltrate sensitive data.

1. Apply patches or updates from Milesight as soon as they become available to address this vulnerability directly. 2. Implement strict input validation and output encoding on all user-supplied data fields, especially the remote_subnet field, to neutralize script tags and prevent injection. 3. Restrict access to the MilesightVPN management interface to trusted networks and IP addresses using firewall rules or VPN segmentation. 4. Employ multi-factor authentication (MFA) for administrative access to reduce the risk of credential compromise. 5. Monitor VPN management logs for unusual access patterns or suspicious activities indicative of exploitation attempts. 6. Educate administrators about the risks of clicking on untrusted links or opening suspicious requests related to the VPN interface. 7. Consider deploying web application firewalls (WAFs) capable of detecting and blocking XSS payloads targeting the VPN management portal. 8. Regularly audit and review VPN configurations and user privileges to minimize exposure.