Stored Cross-Site Scripting (XSS) Vulnerability Affects OZW672 Devices

CVE-2024-36140

5.4MEDIUM

Key Information

Vendor
Siemens
Status
Ozw672
Ozw772
Vendor
CVE Published:
12 November 2024

Summary

A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks.

This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.

Affected Version(s)

OZW672 < 0

OZW772 < 0

Refferences

https://cert-portal.siemens.com/productcert/html/ssa-2304...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.