CVE-2024-36140: XSS
A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks. This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36140?
CVE-2024-36140 has been identified as a high-severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-36140?
To remediate CVE-2024-36140, upgrade the affected devices to version 5.2 or later for both OZW672 and OZW772 firmware.
Which devices are affected by CVE-2024-36140?
CVE-2024-36140 affects all versions of Siemens OZW672 and OZW772 firmware prior to version 5.2.
What type of attack can be executed through CVE-2024-36140?
CVE-2024-36140 can be exploited through stored cross-site scripting (XSS), allowing attackers to inject arbitrary JavaScript code.
Who can exploit CVE-2024-36140?
An authenticated remote attacker can exploit CVE-2024-36140 to execute XSS attacks against the vulnerable devices.