CVE-2021-38701

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-15 · updated 2026-06-17
Weakness: CWE-79

Description

Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0.86; T205 before 4.12.0.62; T204 before 3.28.0.166; and T100, T101, T102, and T103 before 2.6.0.180.

Affected products

Motorola T008 Firmware: before 2.2.0.86 — fixed in 2.2.0.86
Motorola T100 Firmware: before 2.6.0.180 — fixed in 2.6.0.180
Motorola T101 Firmware: before 2.6.0.180 — fixed in 2.6.0.180
Motorola T102 Firmware: before 2.6.0.180 — fixed in 2.6.0.180
Motorola T103 Firmware: before 2.6.0.180 — fixed in 2.6.0.180
Motorola T200 Firmware: before 4.10.0.68 — fixed in 4.10.0.68
Motorola T201 Firmware: before 4.10.0.68 — fixed in 4.10.0.68
Motorola T204 Firmware: before 3.28.0.166 — fixed in 3.28.0.166
Motorola T205 Firmware: before 4.12.0.62 — fixed in 4.12.0.62
Motorola T290 Firmware: before 4.4.0.80 — fixed in 4.4.0.80

How to fix

Upgrade to a fixed version: Motorola T008 Firmware 2.2.0.86; Motorola T100 Firmware 2.6.0.180; Motorola T101 Firmware 2.6.0.180; Motorola T102 Firmware 2.6.0.180; Motorola T103 Firmware 2.6.0.180; Motorola T200 Firmware 4.10.0.68; Motorola T201 Firmware 4.10.0.68; Motorola T204 Firmware 3.28.0.166; Motorola T205 Firmware 4.12.0.62; Motorola T290 Firmware 4.4.0.80. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-38701 or the next vulnerability affects your stack