CVE-2022-46350 Cross-site scripting in SCALANCE X204RNA (HSR)
An attacker can execute malicious scripts on the device's web interface by tricking users into visiting a crafted link, potentially triggering unauthorized requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-46350?
CVE-2022-46350 is a medium-severity cross-site scripting vulnerability in Siemens SCALANCE X204RNA (HSR), published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.
Which versions are affected by CVE-2022-46350?
It affects 5 products.
Products include Siemens 6gk5204-0ba00-2kb2 Firmware, Siemens 6gk5204-0ba00-2mb2 Firmware, Siemens 6gk5204-0bs00-2na3 Firmware, Siemens 6gk5204-0bs00-3la3 Firmware, Siemens 6gk5204-0bs00-3pa3 Firmware.
How do I fix CVE-2022-46350?
No fix has been published for CVE-2022-46350 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-46350 being exploited?
There is no known exploitation of CVE-2022-46350 in the wild and no public exploit code.
Other vulnerabilities in Siemens SCALANCE X204RNA (HSR)
- CVE-2022-46353 Weak cryptography in SCALANCE X204RNA (HSR)
- CVE-2022-46352 Denial of service in SCALANCE X204RNA (HSR)
- CVE-2022-46355 Information disclosure in SCALANCE X204RNA (HSR)
- CVE-2022-46351 Denial of service in SCALANCE X204RNA (HSR)
- CVE-2022-46354 Information disclosure in SCALANCE X204RNA (HSR)
Sources
Also known as GHSA-7c94-jfmg-hjhf.