Strix
26.1K

CVE-2022-36325

MEDIUMCVSS 4.8/10EPSS 0.79%

Last modified

CVE-2022-36325 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.. EPSS estimates a 0.79% chance of exploitation in the next 30 days.

Description

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.

Metrics

CVSS 3.1
4.8/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.79%

51.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SiemensScalance M-800 FirmwareAll versions
SiemensScalance S615 FirmwareAll versions
SiemensScalance Sc-600 Firmware< 2.3.1
SiemensScalance Sc622-2c Firmware< 2.3.1
SiemensScalance Sc632-2c Firmware< 2.3.1
SiemensScalance Sc636-2c Firmware< 2.3.1
SiemensScalance Sc642-2c Firmware< 2.3.1
SiemensScalance Sc646-2c Firmware< 2.3.1
SiemensScalance W700 Ieee 802.11ax FirmwareAll versions
SiemensScalance W700 Ieee 802.11n FirmwareAll versions
SiemensScalance W700 Ieee 802.11ac FirmwareAll versions
SiemensScalance Xb-200 FirmwareAll versions
SiemensScalance Xb205-3 FirmwareAll versions
SiemensScalance Xb205-3ld FirmwareAll versions
SiemensScalance Xb208 FirmwareAll versions
SiemensScalance Xb213-3 FirmwareAll versions
SiemensScalance Xb213-3ld FirmwareAll versions
SiemensScalance Xb216 FirmwareAll versions
SiemensScalance Xc-200 FirmwareAll versions
SiemensScalance Xc206-2 FirmwareAll versions
SiemensScalance Xc206-2g Poe FirmwareAll versions
SiemensScalance Xc206-2g Poe Eec FirmwareAll versions
SiemensScalance Xc206-2sfp Eec FirmwareAll versions
SiemensScalance Xc206-2sfp G FirmwareAll versions
SiemensScalance Xc206-2sfp G \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc206-2sfp G Eec FirmwareAll versions
SiemensScalance Xc208 FirmwareAll versions
SiemensScalance Xc208eec FirmwareAll versions
SiemensScalance Xc208g FirmwareAll versions
SiemensScalance Xc208g \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc208g Eec FirmwareAll versions
SiemensScalance Xc208g Poe FirmwareAll versions
SiemensScalance Xc216 FirmwareAll versions
SiemensScalance Xc216-4c FirmwareAll versions
SiemensScalance Xc216-4c G FirmwareAll versions
SiemensScalance Xc216-4c G \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc216-4c G Eec FirmwareAll versions
SiemensScalance Xc216eec FirmwareAll versions
SiemensScalance Xc224 FirmwareAll versions
SiemensScalance Xc224-4c G FirmwareAll versions
SiemensScalance Xc224-4c G \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc224-4c G Eec FirmwareAll versions
SiemensScalance Xf-200ba FirmwareAll versions
SiemensScalance Xf204-2ba Dna FirmwareAll versions
SiemensScalance Xf204-2ba Irt FirmwareAll versions
SiemensScalance Xm400 FirmwareAll versions
SiemensScalance Xm408-4c FirmwareAll versions
SiemensScalance Xm408-4c L3 FirmwareAll versions
SiemensScalance Xm408-8c FirmwareAll versions
SiemensScalance Xm408-8c L3 FirmwareAll versions

Showing 50 of 90 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-36325?
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
How severe is CVE-2022-36325?
CVE-2022-36325 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 0.79% probability of exploitation in the next 30 days.
How do I fix CVE-2022-36325?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-36325?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST