Vulnerability · Published Mar 8, 2022 · Assigned by siemens

CVE-2021-41541

Medium 6.1

In plain English

A medium-severity cross-site scripting in Climatix POL909 (AWB module) from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)0.6%top 53.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.

Affected products (as reported)

Vendor	Product	Versions
Siemens	Climatix POL909 (AWB module)	All versions < V11.44
Siemens	Climatix POL909 (AWM module)	All versions < V11.36

Weakness: CWE-79

References

https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf x_refsource_MISC