CVE-2018-4848: XSS
First published: Thu Jun 14 2018(Updated: )
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Scalance X-300 Firmware | ||
| Siemens Scalance X-300 Firmware | ||
| Siemens Scalance X-200IRT Firmware | <5.4.1 | |
| Siemens Scalance X-200IRT | ||
| Siemens SCALANCE X-200 series firmware | <5.2.3 | |
| Siemens Scalance X200 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-4848.
What is the affected software for this vulnerability?
The affected software for this vulnerability includes SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), and SCALANCE X-300 switch family (incl. X...
What is the severity of CVE-2018-4848?
The severity of CVE-2018-4848 is medium.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-79 and CWE-80.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability on the following references: http://www.securityfocus.com/bid/104494 and https://cert-portal.siemens.com/productcert/pdf/ssa-480829.pdf
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens scalance x-300 firmware
- canonical/siemens scalance x-200irt firmware
- canonical/siemens scalance x-200irt
- canonical/siemens scalance x-200 series firmware
- canonical/siemens scalance x200