CVE-2020-7575: XSS
First published: Tue Apr 14 2020(Updated: )
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitrary JavaScript code via specially crafted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web sessions.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Climatix Pol908 | ||
| Siemens Climatix Pol908 Firmware | ||
| Siemens Climatix Pol909 | <11.32 | |
| Siemens Climatix Pol909 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2020-7575?
CVE-2020-7575 has been classified as a medium severity vulnerability.
How do I fix CVE-2020-7575?
To mitigate CVE-2020-7575, upgrade to Siemens Climatix POL909 versions equal to or greater than 11.32.
What type of vulnerability is CVE-2020-7575?
CVE-2020-7575 is categorized as a persistent cross-site scripting (XSS) vulnerability.
Which products are affected by CVE-2020-7575?
CVE-2020-7575 affects all versions of Siemens Climatix POL908 and versions of Climatix POL909 that are older than 11.32.
What are the potential impacts of CVE-2020-7575?
The potential impact of CVE-2020-7575 includes the ability for attackers to inject malicious scripts into the web server access log page.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/siemens
- canonical/siemens climatix pol908
- canonical/siemens climatix pol908 firmware
- canonical/siemens climatix pol909
- canonical/siemens climatix pol909 firmware