CVE-2024-28092: UBEE DDW365 XCNDDW365 · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 7.2 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 44% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-28092, organizations should first verify if their network uses UBEE DDW365 XCNDDW365 routers with the affected firmware and hardware versions. Since no official patches are currently available, immediate mitigation includes restricting physical and wireless access to the router’s management interface by: 1) Disabling remote management over Wi-Fi and restricting access to trusted wired networks only. 2) Enforcing strong Wi-Fi encryption (WPA3 or WPA2 with strong passwords) to limit attacker proximity. 3) Changing default router credentials to strong, unique passwords to prevent unauthorized login. 4) Regularly monitoring router logs and configuration for suspicious changes or unexpected entries in the affected fields. 5) If possible, replacing vulnerable routers with models from vendors that provide timely security updates. 6) Employing network segmentation to isolate critical systems from devices managed by vulnerable routers. 7) Educating network administrators about the risks of stored XSS and safe configuration practices. These steps reduce the attack surface and limit the ability of attackers to exploit the vulnerability until a firmware update or patch is released by the vendor.
Description
UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Time Server 1, Time Server 2, Time Server 3, Target, Add Keyword, Add Domain, and Add Allowed Domain.