CVE-2019-13943 Cross-site scripting in EN100 Ethernet module DNP3 variant
Unauthenticated attackers can inject scripts into the web interface of Siemens EN100 modules to read or modify application content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-13943?
CVE-2019-13943 is a medium-severity cross-site scripting vulnerability in Siemens AG EN100 Ethernet module DNP3 variant, published on 12 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module IEC104 variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages, causing the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated to the web interface. This could allow the attacker to read or modify contents of the web application. At the time of advisory publication no public exploitation of this security. vulnerability was known.
Weakness: CWE-79
Which versions are affected by CVE-2019-13943?
It affects 5 products.
Products include Siemens En100 Ethernet Module With Firmware Variant Dnp3 Tcp, Siemens En100 Ethernet Module With Firmware Variant Iec104, Siemens En100 Ethernet Module With Firmware Variant Iec 61850, Siemens En100 Ethernet Module With Firmware Variant Modbus Tcp, Siemens En100 Ethernet Module With Firmware Variant Profinet Io.
How do I fix CVE-2019-13943?
No fix has been published for CVE-2019-13943 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-13943 being exploited?
There is no known exploitation of CVE-2019-13943 in the wild and no public exploit code.
Other vulnerabilities in Siemens AG EN100 Ethernet module DNP3 variant
Sources
Also known as GHSA-x46f-47h6-v9jx.