What’s Vulnerable › Vulnerabilities

CVE-2018-19391

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-03-15 · updated 2026-06-17
• Weakness: CWE-79

Description

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.

Affected products

• Cobham Satcom Sailor 250 Firmware: before 1.25 — fixed in 1.25
• Cobham Satcom Sailor 500 Firmware: before 1.25 — fixed in 1.25

How to fix

Upgrade to a fixed version: Cobham Satcom Sailor 250 Firmware 1.25; Cobham Satcom Sailor 500 Firmware 1.25. Check the vendor advisory for mitigations.

References

• https://cyberskr.com/blog/cobham-satcom-250-500.html
• https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0
• https://cyberskr.com/blog/cobham-satcom-250-500.html
• https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0

Get alerted when CVE-2018-19391 or the next vulnerability affects your stack