CVE-2022-3073

mediumpriority · track · 0EPSS 0.005 · 41 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.48% (41st) EPSS

CVSS 6.1 · medium

Is it mine?

29 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · weidmueller_psirt

EPSS · scored 2026-10-27

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedweidmueller_psirt
Weidmueller strongly recommends customers to install a patched firmware which fixes this vulnerability. The fixed firmware for each affected product with at least version 1.17.0 can be obtained from weidmueller.com.
Mitigationweidmueller_psirt
If the remediation cannot be implemented in a timely manner, Weidmueller strongly recommends that the authenticated user logged in to the product does not click on links from external sources.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · info@cert.vde.comexploitability 2.8 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Weidmüller PSIRT DE

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (29)

Products and version ranges known to be affected.

Quanos Schema ST4 example web templates≤ 1 ≤2enisa_euvdEU
Quanos Schema ST4 example web templates≤ 1enisa_euvdEU
weidmueller 19 iot md01 lan h4 s0011 firmwareall versionsnvdUScpe:2.3:o:weidmueller:19_iot_md01_lan_h4_s0011_firmware:*:*:*:*:*:*:*:*
weidmueller fp iot md01 4eu s2 00000 firmwareall versionsnvdUScpe:2.3:o:weidmueller:fp_iot_md01_4eu_s2_00000_firmware:*:*:*:*:*:*:*:*
weidmueller fp iot md01 lan s2 00000 firmwareall versionsnvdUScpe:2.3:o:weidmueller:fp_iot_md01_lan_s2_00000_firmware:*:*:*:*:*:*:*:*
weidmueller fp iot md01 lan s2 00011 firmwareall versionsnvdUScpe:2.3:o:weidmueller:fp_iot_md01_lan_s2_00011_firmware:*:*:*:*:*:*:*:*
weidmueller fp iot md02 4eu s3 00000 firmwareall versionsnvdUScpe:2.3:o:weidmueller:fp_iot_md02_4eu_s3_00000_firmware:*:*:*:*:*:*:*:*
weidmueller iot-gw30 firmware≤ 1.16.0nvdUScpe:2.3:o:weidmueller:iot-gw30_firmware:*:*:*:*:*:*:*:*
weidmueller iot-gw30-4g-eu firmware≤ 1.16.0nvdUScpe:2.3:o:weidmueller:iot-gw30-4g-eu_firmware:*:*:*:*:*:*:*:*
weidmueller uc20-wl2000-ac firmware≤ 1.16.0nvdUScpe:2.3:o:weidmueller:uc20-wl2000-ac_firmware:*:*:*:*:*:*:*:*
weidmueller uc20-wl2000-iot firmware≤ 1.16.0nvdUScpe:2.3:o:weidmueller:uc20-wl2000-iot_firmware:*:*:*:*:*:*:*:*
Firmware 1.17.0 installed on 19 IOT MD01 LAN H4 S0011 (contains IoT-GW30)all versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on FP IOT MD01 4EU S2 00000 (contains IoT-GW30-4G-EU)all versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on FP IOT MD01 LAN S2 00000 (contains IoT-GW30)all versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on FP IOT MD01 LAN S2 S0011 (contains IoT-GW30)all versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on FP IOT MD02 4EU S3 00000 (contains IoT-GW30-4G-EU)all versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on IoT-GW30all versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on IoT-GW30-4G-EUall versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on UC20-WL2000-ACall versionsfixedweidmueller_psirtDE
Firmware 1.17.0 installed on UC20-WL2000-IOTall versionsfixedweidmueller_psirtDE

showing 20 of 29

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2022-056Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability2022-12-14csaf · weidmueller_psirtDE
A JavaScript injection vulnerability has been discovered in the XML editing system SCHEMA ST4 onlinehelp by Quanos Solutions GmbH. For details refer to CVE.This vulnerability may allow an attacker to inject JavaScript code via URL to the affected products

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd weidmueller_psirt NVD CVE.org MITRE

published 2022-12-14modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan