VDE-2026-071

csafDEjumo_psirt

JUMO: Allegro RomPager webserver vulnerability in JUMO mTRONT, DICON touch, AQUIS touch devices

view advisory published 2026-06-23

Multiple products from JUMO are affected by webserver vulnerability "CVE-2013-6786, CVE-2014-9222, CVE-2014-9223. This vulnerability leads to DOS of the device by using a misfortune cookie and reflected XSS attacks.

01

describes (3)

Related CVEs.

IDseverity exploitable
CVE-2014-9223UShigh10.0—
Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote attackers to cause a denial of service or po…
CVE-2014-9222UShigh10.0Exploit
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that…
CVE-2013-6786USmedium4.3—
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DS…
02

references

External citations — patches, advisories, analysis.

03

remediations (3)

  • Fixed

    Update affected devices to: Version 248.05.02 for JUMO mTRON T Central Processing Unit Version 249.05.03 for JUMO mTRON T Multifunction panel 840 Version 266.04.07 for JUMO DICON touch Version 304.09.04 for JUMO AQUIS touch

  • Fixed

    Update affected devices to: Version 248.05.02 for JUMO mTRON T Central Processing Unit Version 249.05.03 for JUMO mTRON T Multifunction panel 840 Version 266.04.07 for JUMO DICON touch Version 304.09.04 for JUMO AQUIS touch

  • Fixed

    Update affected devices to: Version 248.05.02 for JUMO mTRON T Central Processing Unit Version 249.05.03 for JUMO mTRON T Multifunction panel 840 Version 266.04.07 for JUMO DICON touch Version 304.09.04 for JUMO AQUIS touch

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan