CVE-2015-4174

Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

• CWE-79

• http://packetstormsecurity.com/files/132514/Climatix-BACnet-IP-Communication-Module-Cross-Site-Scripting.htmlExploit
• http://www.securityfocus.com/bid/75427
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-142512.pdfPatch, Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01Third Party Advisory, US Government Resource
• http://packetstormsecurity.com/files/132514/Climatix-BACnet-IP-Communication-Module-Cross-Site-Scripting.htmlExploit
• http://www.securityfocus.com/bid/75427
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-142512.pdfPatch, Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01Third Party Advisory, US Government Resource

Published

Jun 28, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4166Cloudera Key Trustee Server before 5.4.3 does not store keys…
• CVE-2015-4167The udf_read_inode function in fs/udf/inode.c in the Linux k…
• CVE-2015-4169Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-4170Race condition in the ldsem_cmpxchg function in drivers/tty/…
• CVE-2015-4171strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN…
• CVE-2015-4173Unquoted Windows search path vulnerability in the autorun va…
• CVE-2015-4176fs/namespace.c in the Linux kernel before 4.0.2 does not pro…
• CVE-2015-4177The collect_mounts function in fs/namespace.c in the Linux k…
• CVE-2015-4178The fs_pin implementation in the Linux kernel before 4.0.5 d…
• CVE-2015-4179Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-4180Directory traversal vulnerability in get_file.php in phpMyBa…
• CVE-2015-4181Directory traversal vulnerability in get_file.php in phpMyBa…