4.8
CVE-2022-36325
- EPSS 0.94%
- Veröffentlicht 10.08.2022 12:15:12
- Zuletzt bearbeitet 14.04.2026 09:16:32
- Erkennungen
LoginAffected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Scalance Sc-600 Firmware Version < 2.3.1
Siemens ≫ Scalance Sc622-2c Firmware Version < 2.3.1
Siemens ≫ Scalance Sc632-2c Firmware Version < 2.3.1
Siemens ≫ Scalance Sc636-2c Firmware Version < 2.3.1
Siemens ≫ Scalance Sc642-2c Firmware Version < 2.3.1
Siemens ≫ Scalance Sc646-2c Firmware Version < 2.3.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.94% | 0.575 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| Siemens | 6.8 | 0.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
|
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdf
https://cert-portal.siemens.com/productcert/html/ssa-019200.html
https://cert-portal.siemens.com/productcert/html/ssa-710008.html