Vulnerability · Published Aug 14, 2020 · Assigned by siemens

CVE-2020-15781

Critical 9.6

In plain English

A critical-severity cross-site scripting in SICAM WEB firmware for SICAM A8000 RTUs from Siemens AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS NVD)9.6Critical

Exploit odds (30 days)1.0%top 37.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application.

Affected products (as reported)

Vendor	Product	Versions
Siemens AG	SICAM WEB firmware for SICAM A8000 RTUs	All versions < V05.30

Weakness: CWE-79

References

https://cert-portal.siemens.com/productcert/pdf/ssa-370042.pdf x_refsource_MISC