CVE-2009-4406

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-12-23 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2, running rpdu 3.3.3 or 3.7.0 on AOS 3.3.4, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the login_username parameter.

Affected products

Apc Ap7932 B2: all versions
Apc Ap7932 B2 Firmware: 3.3.3, 3.7.0

References

http://www.packetstormsecurity.org/0912-exploits/apc-xss.txt
http://www.securityfocus.com/archive/1/508468/100/0/threaded
http://www.securityfocus.com/bid/37338
http://www.securitytracker.com/id?1023331
https://exchange.xforce.ibmcloud.com/vulnerabilities/54824
http://www.packetstormsecurity.org/0912-exploits/apc-xss.txt
http://www.securityfocus.com/archive/1/508468/100/0/threaded
http://www.securityfocus.com/bid/37338
http://www.securitytracker.com/id?1023331
https://exchange.xforce.ibmcloud.com/vulnerabilities/54824

Get alerted when CVE-2009-4406 or the next vulnerability affects your stack