CVE-2023-5880 is a cross-site scripting flaw (CVSS 8.8 High in the NVD record) on the setup page of the Genie Aladdin Connect retrofit kit, model ALDCM. A nearby Wi-Fi network name containing script can run in the browser of the person doing setup. Rapid7 advises configuring the device with the mobile app. Genie calls the impact very low.
What's affected
- Product: Genie Company Aladdin Connect garage door opener retrofit kit, model ALDCM, during Wi-Fi configuration mode.
- Affected: the record gives no version range. Rapid7 tested the retrofit kit and the Android app version 5.65 build 2075.
- Fixed version: Rapid7 does not list a fixed firmware for this CVE. Genie says the mitigation is to use the mobile app for setup.
- Severity: 8.8 High in the NVD record. Genie describes it as a very low impact issue with minimal risk, because it only occurs while the owner has the device in setup mode and an attacker is within Wi-Fi range. Both views are reported here.
How to check if you're exposed
This flaw only exists while the device is in configuration mode, so exposure is brief and local. Ask a simple question: has anyone set up or reset a kit by using the device's own web page instead of the mobile app? If setup always went through the mobile app, the vulnerable page was never used.
If you need to put a kit into setup mode, look at the Wi-Fi networks nearby first. Network names that contain markup or odd symbols are a warning sign. Do not continue with the browser setup page in that case.
What to do now
- Configure or reconfigure the retrofit kit with the Aladdin Connect mobile app, which avoids the vulnerable setup page.
- Do not start browser based setup if you can see strangely named Wi-Fi networks nearby.
- Keep the kit on a network you own and control, and do not expose it to the internet.
- Ask Genie customer service which software version your kit runs and whether it has the latest update.
- Re-check the vendor and Rapid7 pages for new guidance on this CVE.
Why it matters
The setup page prints the names of nearby Wi-Fi networks without neutralizing them. A network name can be up to a limited length and can contain HTML or script characters, so a person nearby can broadcast a name that the page treats as code. That is CWE-79, cross-site scripting, and Rapid7 notes that no user interaction is needed beyond viewing the page during setup.
The NVD score treats it as serious because script in a device page can act with that page's trust. Genie's view is that the setup window is short and needs radio proximity, so real risk is small. Both points hold. For defenders the sensible takeaway is cheap: use the supported setup path and keep IoT devices off the open internet. The record does not list this CVE as known exploited.
Quick check
Do I need to replace the device?
Nothing in the sources says so. Rapid7 and Genie both point to the mobile app as the safe way to set the kit up.
Sources
Last reviewed: 19 October 2026.
