CVE-2022-40181 Cross-site scripting in Desigo PXM30-1
Remote attackers can exploit embedded browser URI handling to execute JavaScript, read files, or cause denial of service on Siemens Desigo devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40181?
CVE-2022-40181 is a high-severity cross-site scripting vulnerability in Siemens Desigo PXM30-1, published on 11 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions.
Which versions are affected by CVE-2022-40181?
It affects 10 products.
Products include Siemens Desigo Pxm30-1 Firmware, Siemens Desigo Pxm30.e Firmware, Siemens Desigo Pxm40-1 Firmware, Siemens Desigo Pxm40.e Firmware, Siemens Desigo Pxm50-1 Firmware, Siemens Desigo Pxm50.e Firmware and 4 more.
How do I fix CVE-2022-40181?
No fix has been published for CVE-2022-40181 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-40181 being exploited?
There is no known exploitation of CVE-2022-40181 in the wild and no public exploit code.
Other vulnerabilities in Siemens Desigo PXM30-1
Sources
Also known as GHSA-r9x8-x33r-r8q2.