Vulnerability in Siemens Desigo Pxc4

CVE-2022-24039

A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such that it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges, by poisoning any of the content used to generate XLS reports, could be able to leverage the application to deliver malicious files against higher-privileged users and obtain Remote Code Execution (RCE) against the administrator’s workstation.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.020 (80.7th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 80.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-24039: held from 0.020 to 0.020.

EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: +0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2022-24039?
CVE-2022-24039 is a critical-severity vulnerability in Siemens Desigo Pxc4, classified under CWE-75. CVSS score: 9.0/10. Published 2022-05-10.
How severe is CVE-2022-24039?
Critical severity. CVSS v3 base score is 9.0 out of 10.