Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2019-19393 — Proof-of-concept for stored XSS vulnerability in Rittal CMC PU III web management interface, enabling persistent client-side script injection before and after login. | Kitploit
Tools/GitHubGitHub/miguelhamal/cve-2019-19393
IoT SecurityVulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityHardware Security
GitHubmiguelhamal/cve-2019-19393

CVE-2019-19393

Proof-of-concept for stored XSS vulnerability in Rittal CMC PU III web management interface, enabling persistent client-side script injection before and after login.

View Repository
45 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Rittal CMC PU III – Stored XSS PoC

Application: Rittal CMC PU III Web management

Devices: CMC PU III 7030.000

Software Revision: From V3.11.00_2 to V3.15.70_4

Hardware Revision: From V3.00 to V6.01

Attack type: Stored XSS

Solution: Update to Software Revision V3.17.10 or later

Summary: Web application fails to sanitize user input on system configurations page. This allows attacker to backdoor the device with HTML and browser interpreted content (such as JS or other client-side scripts) as the content is displayed always after and before login. Persistent XSS allows attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface either with valid credentials or hijacked session.

Technical Description: See CVE-2019-19393.pdf

Timeline:

  • 2019-11-11 Issues discovered
  • 2019-11-28 First contact with vendor via e-mail
  • 2020-03-02 Second contact with vendor via e-mail
  • 2020-03-02 Vendor response. XSS vulnerabilities were already detected, and would be patched in the next release
  • 2020-08-20 New Software Version release. V3.17.10
  • 2020-09-28 Vulnerability patch confirmed
Download Tool