Reflected Cross-Site Scripting Vulnerability in RUGGEDCOM ROX Series by Siemens

CVE-2023-36389

What is CVE-2023-36389?

A reflected cross-site scripting (XSS) vulnerability is present in the web interface of the RUGGEDCOM ROX Series, including models MX5000, RX1400, RX1500, and others prior to version 2.16.0. This flaw allows an attacker to execute arbitrary JavaScript code in the context of the victim’s web browser. By crafting a malicious link, an attacker can trick users into clicking it, subsequently reflecting the malformed value in the response without proper sanitization, which poses significant security risks. Users receiving the 'invalid path' error could unknowingly expose their session or other sensitive data to the attacker.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References