VulnerabilityModified
CVE-2022-36325
This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
MEDIUM 4.8EPSS 0.94%
Does this matter?
Lower severity and a low EPSS score (0.94%). Track it; it rarely justifies an emergency change on its own.
Description
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.94% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-80
- Affected
- siemens/scalance m-800 firmware · siemens/scalance s615 firmware · siemens/scalance sc-600 firmware · siemens/scalance sc622-2c firmware · siemens/scalance sc632-2c firmware · siemens/scalance sc636-2c firmware · siemens/scalance sc642-2c firmware · siemens/scalance sc646-2c firmware · siemens/scalance w700 ieee 802.11ax firmware · siemens/scalance w700 ieee 802.11n firmware · siemens/scalance w700 ieee 802.11ac firmware · siemens/scalance xb-200 firmware · siemens/scalance xb205-3 firmware · siemens/scalance xb205-3ld firmware · siemens/scalance xb208 firmware · siemens/scalance xb213-3 firmware · siemens/scalance xb213-3ld firmware · siemens/scalance xb216 firmware · siemens/scalance xc-200 firmware · siemens/scalance xc206-2 firmware · +40 more
- Source
- productcert@siemens.com
References
- https://cert-portal.siemens.com/productcert/html/ssa-019200.html
- https://cert-portal.siemens.com/productcert/html/ssa-710008.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdfMitigation, Vendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdfMitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.