Vulnerability · Published Nov 12, 2024 · Assigned by siemens

CVE-2024-36140

Medium 6.8

In plain English

A medium-severity cross-site scripting in OZW672 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 75.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks. This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.

Affected products (as reported)

Vendor	Product	Versions
Siemens	OZW672	0 – before V5.2
Siemens	OZW772	0 – before V5.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

References

https://cert-portal.siemens.com/productcert/html/ssa-230445.html