VulnerabilityModified

CVE-2019-13923

A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions).

CRITICAL 9.6EPSS 1.12%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.

CVSS 3.1: 9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS: 1.12% probability · 64th percentile
CISA KEV: Not listed
Weakness: CWE-80, CWE-79
Affected: siemens/ie\/wsn-pa link wirelesshart gateway firmware
Source: productcert@siemens.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.