CVE-2024-8776: INTUMIT SmartRobot - Cross-site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-16 · updated 2026-06-17
Weakness: CWE-79

Description

SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript code to the parameter for Reflected Cross-site Scripting attacks.

Affected products

INTUMIT SmartRobot: before 7.1.0 — fixed in 7.1.0

How to fix

Upgrade to a fixed version: INTUMIT SmartRobot 7.1.0. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/en/cp-139-8070-d10bc-2.html
https://www.twcert.org.tw/tw/cp-132-8069-73393-1.html

Get alerted when CVE-2024-8776 or the next vulnerability affects your stack