CVE-2024-48197

Deeper analysis

CVE-2024-48197 is a cross-site scripting vulnerability, tracked under CWE-79, that affects the Audiocodes MP-202b device running firmware version 4.4.3. The flaw resides in the login page of the web interface and carries a CVSS 3.1 base score of 4.7, reflecting network attack vector, low complexity, no required privileges, required user interaction, and changed scope with limited integrity impact.

A remote attacker can exploit the issue by delivering a crafted payload through the web login page, enabling privilege escalation within the affected device. The attack requires a victim user to interact with the malicious content, after which the attacker can perform actions under the compromised session context.

The EPSS score for this CVE rose from lower values after disclosure to a peak of 0.0625 on 2026-02-10 before receding to the current 0.0454, indicating a measurable increase in observed exploitation interest that warrants renewed monitoring. Public references point to the vendor site, a device-specific domain, and a GitHub repository containing further technical details, though no official patch or mitigation guidance is described in the available references.