CVE-2023-49296
MEDIUMDescription
The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vulnerability in versions prior to 1.3.6 affects the endpoint `/certificate.crt` and the way the web interface of the ArduinoCreateAgent handles custom error messages. An attacker that is able to persuade a victim into clicking on a malicious link can perform a Reflected Cross-Site Scripting attack on the web interface of the create agent, which would allow the attacker to execute arbitrary browser client side code. Version 1.3.6 contains a fix for the issue.
How to fix
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Exploit Intelligence
Low risk: more likely to be exploited than 17% of all known CVEs.
References
Related Vulnerabilities
Other CWE-79 (Cross-Site Scripting (XSS)) vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2020-11022 | Medium | 6.9 | 99% | - | Fix |
| CVE-2019-3929 | Critical | 9.8 | 99% | KEV | Fix |
| CVE-2020-9496 | Medium | 6.1 | 99% | - | - |
| CVE-2023-28341 | Medium | 6.1 | 99% | - | Fix |
| CVE-2018-12998 | Medium | 6.1 | 98% | - | - |
| CVE-2025-4123 | High | 7.6 | 98% | - | Fix |
Embed a live status badge for CVE-2023-49296
Markdown
[](https://tridentstack.com/cve/CVE-2023-49296)HTML
<a href="https://tridentstack.com/cve/CVE-2023-49296"><img src="https://tridentstack.com/cve/badge/CVE-2023-49296.svg" alt="CVE-2023-49296"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.