2 results (0.003 seconds)

CVSS: 6.9EPSS: 0%CPEs: 87EXPL: 0

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load. • https://cert-portal.siemens.com/productcert/html/ssa-054046.html • CWE-288: Authentication Bypass Using an Alternate Path or Channel •

CVSS: 5.1EPSS: 0%CPEs: 117EXPL: 0

The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted link. • https://cert-portal.siemens.com/productcert/html/ssa-876787.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •