8.3

CVE-2022-40181

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions.

Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Desigo Pxm30-1 Firmware Version < 02.20.126.11-41
   Siemens ≫ Desigo Pxm30-1 Version-
Siemens ≫ Desigo Pxm30.E Firmware Version < 02.20.126.11-41
   Siemens ≫ Desigo Pxm30.E Version-
Siemens ≫ Desigo Pxm40-1 Firmware Version < 02.20.126.11-41
   Siemens ≫ Desigo Pxm40-1 Version-
Siemens ≫ Desigo Pxm40.E Firmware Version < 02.20.126.11-41
   Siemens ≫ Desigo Pxm40.E Version-
Siemens ≫ Desigo Pxm50-1 Firmware Version < 02.20.126.11-41
   Siemens ≫ Desigo Pxm50-1 Version-
Siemens ≫ Desigo Pxm50.E Firmware Version < 02.20.126.11-41
   Siemens ≫ Desigo Pxm50.E Version-
Siemens ≫ Pxg3.W100-1 Firmware Version < 02.20.126.11-37
   Siemens ≫ Pxg3.W100-1 Version-
Siemens ≫ Pxg3.W100-2 Firmware Version < 02.20.126.11-41
   Siemens ≫ Pxg3.W100-2 Version-
Siemens ≫ Pxg3.W200-1 Firmware Version < 02.20.126.11-37
   Siemens ≫ Pxg3.W200-1 Version-
Siemens ≫ Pxg3.W200-2 Firmware Version < 02.20.126.11-41
   Siemens ≫ Pxg3.W200-2 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.45% 0.628
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.3 2.8 5.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.