# Exploit Title: Dinstar FXO Analog VoIP Gateway DAG2000-16O Stored Cross Site Scripting # Google Dork: NA # Date: 25/10/2022 # Exploit Author: Yehia Elghaly # Vendor Homepage: https://www.dinstar.com/ # Software Link: https://www.dinstar.com/analog-voip-gateway/16-fxo/ # Version: DAG2000-16O # CVE: N/A Summary: DAG1000-16O FXO analog gateway is a type of access gateway offering seamless connectivity between IP-based telephony networks and legacy telephones (POTS) and PBX systems. The analog gateway has 16 FXO ports and is used to connect to analog PBX or the PSTN lines of telecom carriers. With the standard SIP protocol, it's compatible with leading IMS/NGN platforms and SIP-based IP Phone systems. It provides low-cost and easy-to-use VoIP solutions for small and medium businesses, call centers, SOHO, remote offices as well as enterprises with multiple branches. Description: The attacker can able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.: Stored XSS found on when (Add new Port) affected field is (Primary Authenticate ID) Payload: <script>alert(44)</script> [Affected Component] (Add new Port)--> (Primary Authenticate ID)