Sign-up

ID

VAR-202411-0737


CVE

CVE-2024-36140


TITLE

Siemens'  OZW672  firmware and  OZW772  Cross-site scripting vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-012845

DESCRIPTION

A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks. This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker. Siemens' OZW672 firmware and OZW772 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. OZW devices (web servers) are used to remotely monitor building controller devices, such as heating controls or air conditioning. Siemens OZW devices (web servers) have a cross-site scripting vulnerability that can be exploited by attackers to inject arbitrary JavaScript code

Trust: 2.16

sources: NVD: CVE-2024-36140 // JVNDB: JVNDB-2024-012845 // CNVD: CNVD-2024-45220

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-45220

AFFECTED PRODUCTS

vendor:siemensmodel:ozw672scope:ltversion:5.2

Trust: 1.6

vendor:siemensmodel:ozw772scope:ltversion:5.2

Trust: 1.6

vendor:シーメンスmodel:ozw772scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:ozw672scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2024-45220 // JVNDB: JVNDB-2024-012845 // NVD: CVE-2024-36140

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-36140
value: MEDIUM

Trust: 1.0

productcert@siemens.com: CVE-2024-36140
value: HIGH

Trust: 1.0

NVD: CVE-2024-36140
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2024-45220
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2024-45220
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:C/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-36140
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2024-36140
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 4.0
version: 3.1

Trust: 1.0

NVD: CVE-2024-36140
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-45220 // JVNDB: JVNDB-2024-012845 // NVD: CVE-2024-36140 // NVD: CVE-2024-36140

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-012845 // NVD: CVE-2024-36140

PATCH

title:Patch for Siemens OZW devices (web servers) cross-site scripting vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/617291

Trust: 0.6

sources: CNVD: CNVD-2024-45220

EXTERNAL IDS

db:NVDid:CVE-2024-36140

Trust: 3.2

db:SIEMENSid:SSA-230445

Trust: 2.4

db:ICS CERTid:ICSA-24-319-03

Trust: 0.8

db:JVNid:JVNVU96191615

Trust: 0.8

db:JVNDBid:JVNDB-2024-012845

Trust: 0.8

db:CNVDid:CNVD-2024-45220

Trust: 0.6

sources: CNVD: CNVD-2024-45220 // JVNDB: JVNDB-2024-012845 // NVD: CVE-2024-36140

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-230445.html

Trust: 2.4

url:https://jvn.jp/vu/jvnvu96191615/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-36140

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-03

Trust: 0.8

sources: CNVD: CNVD-2024-45220 // JVNDB: JVNDB-2024-012845 // NVD: CVE-2024-36140

SOURCES

db:CNVDid:CNVD-2024-45220
db:JVNDBid:JVNDB-2024-012845
db:NVDid:CVE-2024-36140

LAST UPDATE DATE

2024-11-28T20:10:13.609000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-45220date:2024-11-18T00:00:00
db:JVNDBid:JVNDB-2024-012845date:2024-11-18T04:46:00
db:NVDid:CVE-2024-36140date:2024-11-15T22:53:26.063

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-45220date:2024-11-18T00:00:00
db:JVNDBid:JVNDB-2024-012845date:2024-11-18T00:00:00
db:NVDid:CVE-2024-36140date:2024-11-12T13:15:07.957