CVE-2018-4842: XSS
First published: Thu Jun 14 2018(Updated: )
A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). A remote, authenticated attacker with access to the configuration web server could be able to store script code on the web site, if the HRP redundancy option is set. This code could be executed in the web browser of victims visiting this web site (XSS), affecting its confidentiality, integrity and availability. User interaction is required for successful exploitation, as the user needs to visit the manipulated web site. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Scalance X200irt Firmware | <5.4.1 | |
| Siemens Scalance X200 Irt | ||
| Siemens Scalance X300 Firmware | ||
| Siemens Scalance X300 | ||
| Siemens Scalance X200 Firmware | <5.2.3 | |
| Siemens Scalance X200 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-4842?
CVE-2018-4842 is a vulnerability identified in SCALANCE X-200IRT switch family and SCALANCE X-300 switch family.
What is the severity of CVE-2018-4842?
The severity of CVE-2018-4842 is medium with a CVSS score of 4.8.
Which software versions are affected by CVE-2018-4842?
All versions prior to V5.4.1 of SCALANCE X-200IRT switch family, SCALANCE X-200RNA switch family, and all versions prior to V4.1.3 of SCALANCE X-300 switch family are affected.
How can I fix CVE-2018-4842?
Update your SCALANCE X-200IRT switch family and SCALANCE X-300 switch family to versions V5.4.1 and V4.1.3 or higher, respectively.
Where can I find more information on CVE-2018-4842?
You can find more information on CVE-2018-4842 at the following references: [Siemens ProductCERT](https://cert-portal.siemens.com/productcert/pdf/ssa-480829.pdf) and [SecurityFocus](https://www.securityfocus.com/bid/104494).
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/type
- agent/tags
- agent/event
- agent/weakness
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/siemens
- canonical/siemens scalance x200irt firmware
- canonical/siemens scalance x200 irt
- canonical/siemens scalance x300 firmware
- canonical/siemens scalance x300
- canonical/siemens scalance x200 firmware
- canonical/siemens scalance x200