XSS in Siemens Desigo Pxm30-1

CVE-2022-40181

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H.

EPSS exploit prediction

EPSS: 0.010 (62.6th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 62.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-40181: held from 0.009 to 0.010.

EPSS over last 30 days · oldest: 0.009 · newest: 0.010 · change: +0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2022-40181?
CVE-2022-40181 is a high-severity vulnerability in Siemens Desigo Pxm30-1, classified under CWE-84. CVSS score: 8.3/10. Published 2022-10-11.
How severe is CVE-2022-40181?
High severity. CVSS v3 base score is 8.3 out of 10.