Cross-Site Scripting Vulnerability in SCALANCE Switches by Siemens

CVE-2018-4842

Summary

A Cross-Site Scripting vulnerability has been detected in multiple families of Siemens SCALANCE switches. Specifically, if the HRP redundancy option is enabled, an authenticated attacker can exploit the configuration web server to store malicious script code. This script may execute in the browsers of users who visit the compromised site, leading to potential breaches of confidentiality, integrity, and availability. Although user interaction is required to trigger the exploit—where users need to visit a manipulated site—there has been no known public exploitation reported as of now. Siemens has acknowledged the issue and is providing mitigations for users to secure their systems.

References