CVE-2022-46350

Published: Dic 13, 2022 Last Modified: Apr 22, 2025 EU-VD ID: EUVD-2022-49166 Aliases: GSD-2022-46350
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none

Description

AI Translation Available

A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0067
Percentile
0,7th
Updated

EPSS Score Trend (Last 90 Days)

79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Integrity Availability
Potential Impacts:
Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
Operating System

6Gk5204-0Bs00-3Pa3 Firmware by Siemens

Product Information
Vendor Siemens
Product 6Gk5204-0Bs00-3Pa3 Firmware
Version Range Affected
To 3.2.7 (exclusive)
cpe:2.3:o:siemens:6gk5204-0bs00-3pa3_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

6Gk5204-0Ba00-2Mb2 Firmware by Siemens

Product Information
Vendor Siemens
Product 6Gk5204-0Ba00-2Mb2 Firmware
Version Range Affected
To 3.2.7 (exclusive)
cpe:2.3:o:siemens:6gk5204-0ba00-2mb2_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

6Gk5204-0Bs00-3La3 Firmware by Siemens

Product Information
Vendor Siemens
Product 6Gk5204-0Bs00-3La3 Firmware
Version Range Affected
To 3.2.7 (exclusive)
cpe:2.3:o:siemens:6gk5204-0bs00-3la3_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

6Gk5204-0Ba00-2Kb2 Firmware by Siemens

Product Information
Vendor Siemens
Product 6Gk5204-0Ba00-2Kb2 Firmware
Version Range Affected
To 3.2.7 (exclusive)
cpe:2.3:o:siemens:6gk5204-0ba00-2kb2_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

6Gk5204-0Bs00-2Na3 Firmware by Siemens

Product Information
Vendor Siemens
Product 6Gk5204-0Bs00-2Na3 Firmware
Version Range Affected
To 3.2.7 (exclusive)
cpe:2.3:o:siemens:6gk5204-0bs00-2na3_firmware:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://cert-portal.siemens.com/productcert/pdf/ssa-363821.…
Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-363821.…
Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf