CVE-2018-4842: XSS
A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). A remote, authenticated attacker with access to the configuration web server could be able to store script code on the web site, if the HRP redundancy option is set. This code could be executed in the web browser of victims visiting this web site (XSS), affecting its confidentiality, integrity and availability. User interaction is required for successful exploitation, as the user needs to visit the manipulated web site. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-4842?
CVE-2018-4842 is a vulnerability identified in SCALANCE X-200IRT switch family and SCALANCE X-300 switch family.
What is the severity of CVE-2018-4842?
The severity of CVE-2018-4842 is medium with a CVSS score of 4.8.
Which software versions are affected by CVE-2018-4842?
All versions prior to V5.4.1 of SCALANCE X-200IRT switch family, SCALANCE X-200RNA switch family, and all versions prior to V4.1.3 of SCALANCE X-300 switch family are affected.
How can I fix CVE-2018-4842?
Update your SCALANCE X-200IRT switch family and SCALANCE X-300 switch family to versions V5.4.1 and V4.1.3 or higher, respectively.
Where can I find more information on CVE-2018-4842?
You can find more information on CVE-2018-4842 at the following references: [Siemens ProductCERT](https://cert-portal.siemens.com/productcert/pdf/ssa-480829.pdf) and [SecurityFocus](https://www.securityfocus.com/bid/104494).