SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2022-40178

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1…

MEDIUM 5.4EPSS 0.51%

Does this matter?

Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Improper Neutralization of Input During Web Page Generation exists in the “Import Files“ functionality of the “Operation” web application, due to the missing validation of the titles of files included in the input package. By uploading a specifically crafted graphics package, a remote low-privileged attacker can execute arbitrary JavaScript code.

CVSS 3.1
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.51% probability · 42th percentile
CISA KEV
Not listed
Weakness
CWE-79
Affected
siemens/desigo pxm30-1 firmware · siemens/desigo pxm30.e firmware · siemens/desigo pxm40-1 firmware · siemens/desigo pxm40.e firmware · siemens/desigo pxm50-1 firmware · siemens/desigo pxm50.e firmware · siemens/pxg3.w100-1 firmware · siemens/pxg3.w100-2 firmware · siemens/pxg3.w200-1 firmware · siemens/pxg3.w200-2 firmware
Source
productcert@siemens.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.