CVE-2018-11448: XSS
First published: Tue Jun 26 2018(Updated: )
A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a stored Cross-Site Scripting (XSS) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires that the attacker has access to the web interface of an affected device. The attacker must be authenticated as administrative user on the web interface. Afterwards, a legitimate user must access the web interface. A successful attack could allow an attacker to execute malicious code in the browser of a legitimate user. At the time of advisory publication no public exploitation of this security vulnerability was known.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Scalance M875 Firmware | ||
| Siemens SCALANCE M875 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-11448?
The severity of CVE-2018-11448 is medium due to the potential for stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2018-11448?
To fix CVE-2018-11448, update the SCALANCE M875 firmware to the latest version provided by Siemens.
What systems are affected by CVE-2018-11448?
CVE-2018-11448 affects all versions of the Siemens SCALANCE M875 through its web interface on port 443/tcp.
What type of attack is possible with CVE-2018-11448?
CVE-2018-11448 allows for a stored Cross-Site Scripting (XSS) attack when a user interacts with a malicious link.
Can CVE-2018-11448 be exploited remotely?
Yes, CVE-2018-11448 can potentially be exploited remotely if an attacker can trick a user into accessing their malicious link.
- agent/weakness
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/references
- agent/author
- agent/softwarecombine
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/siemens
- canonical/siemens scalance m875 firmware
- canonical/siemens scalance m875