Back
CVE-2024-9969
NewType WebEIP v3.0 - Reflected XSS
Medium5.4EPSS 0.29%
- Published
- Updated
- Reserved
- Assigned by
- twcert
Description
NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, resulting in a Reflected Cross-site Scripting (XSS) attack. The affected product is no longer maintained. It is recommended to upgrade to the new product.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| twcertCNA (assigner) | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.29% · top 79% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.
Weakness
Affected products
What to do
Solution: The vendor has stated that WebEIP v3.0 has been released for over 15 years and is no longer supported or maintained. It is recommended to upgrade to the new WebEIP Pro product.
References (2)
- https://www.twcert.org.tw/tw/cp-132-8134-c476d-1.html (opens in a new tab)third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8135-ce1e6-2.html (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-9969)Record last updated .