Reflected Cross-Site Scripting Vulnerability in RUGGEDCOM ROX Series by Siemens

CVE-2023-36389

Summary

A reflected cross-site scripting (XSS) vulnerability is present in the web interface of the RUGGEDCOM ROX Series, including models MX5000, RX1400, RX1500, and others prior to version 2.16.0. This flaw allows an attacker to execute arbitrary JavaScript code in the context of the victim’s web browser. By crafting a malicious link, an attacker can trick users into clicking it, subsequently reflecting the malformed value in the response without proper sanitization, which poses significant security risks. Users receiving the 'invalid path' error could unknowingly expose their session or other sensitive data to the attacker.

References