Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability
A JavaScript injection vulnerability has been discovered in the XML editing system SCHEMA ST4 onlinehelp by Quanos Solutions GmbH. For details refer to CVE.This vulnerability may allow an attacker to inject JavaScript code via URL to the affected products
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-3073US | — | — | ||
Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack e… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2022-056: Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability - HTMLself
- CERT@VDE Security Advisories for Weidmueller Interface GmbH & Co. KGexternal
- VDE-2022-056: Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability - CSAFself
- Vendor PSIRTexternal
Behebungen (2)
- Mitigation
If the remediation cannot be implemented in a timely manner, Weidmueller strongly recommends that the authenticated user logged in to the product does not click on links from external sources.
- Behoben
Weidmueller strongly recommends customers to install a patched firmware which fixes this vulnerability. The fixed firmware for each affected product with at least version 1.17.0 can be obtained from weidmueller.com.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan