Siemens Desigo PXG3.W200-2 Device Embedded Browser cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Siemens Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, Desigo PXG3.W100-1, Desigo PXG3.W100-2, Desigo PXG3.W200-1 and Desigo PXG3.W200-2. This affects an unknown part of the component Device Embedded Browser. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2022-40181. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Siemens Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, Desigo PXG3.W100-1, Desigo PXG3.W100-2, Desigo PXG3.W200-1 and Desigo PXG3.W200-2. Affected by this vulnerability is an unknown functionality of the component Device Embedded Browser. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-84. The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions.

The weakness was released 10/11/2022 as ssa-360783. The advisory is shared at cert-portal.siemens.com. This vulnerability is known as CVE-2022-40181 since 09/08/2022. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Siemens

Name

• Desigo PXG3.W100-1
• Desigo PXG3.W100-2
• Desigo PXG3.W200-1
• Desigo PXG3.W200-2
• Desigo PXM30-1
• Desigo PXM30.E
• Desigo PXM40-1
• Desigo PXM40.E
• Desigo PXM50-1
• Desigo PXM50.E

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion