Vulnerability · Published Oct 15, 2020 · Assigned by siemens
CVE-2020-15793
Medium 5.4
In plain English
A medium-severity security flaw in Desigo Insight from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user to click on a website controlled by the attacker.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Desigo Insight | All versions |
Weakness: CWE-1021
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf x_refsource_MISC
- https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05 x_refsource_MISC