CVE-2018-25090

Wago: Improper Neutralization of Input During Web Page Generation in multiple devices

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.

Un atacante remoto no autenticado puede utilizar un ataque XSS debido a una neutralización inadecuada de la entrada durante la generación de la página web. Se requiere la interacción del usuario. Esto conduce a un impacto limitado en la confidencialidad e integridad, pero ningún impacto en la disponibilidad.

*Credits: N/A

CVSS Scores

CERT VDEv3.1 5.4

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-09-14 CVE Reserved
2024-03-13 CVE Published
2024-03-14 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (1)

URL	Tag	Source
https://cert.vde.com/en/advisories/VDE-2023-039

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
WAGO Search vendor "WAGO"		Controller BACnet/IP Search vendor "WAGO" for product "Controller BACnet/IP"				<= FW13 Search vendor "WAGO" for product "Controller BACnet/IP" and version " <= FW13"		en		Affected
WAGO Search vendor "WAGO"		Controller BACnet MS/TP Search vendor "WAGO" for product "Controller BACnet MS/TP"				<= FW13 Search vendor "WAGO" for product "Controller BACnet MS/TP" and version " <= FW13"		en		Affected
WAGO Search vendor "WAGO"		Ethernet Controller 3rd Generation Search vendor "WAGO" for product "Ethernet Controller 3rd Generation"				<= FW13 Search vendor "WAGO" for product "Ethernet Controller 3rd Generation" and version " <= FW13"		en		Affected
WAGO Search vendor "WAGO"		Ethernet Controller 3rd Generation Search vendor "WAGO" for product "Ethernet Controller 3rd Generation"				<= FW13 Search vendor "WAGO" for product "Ethernet Controller 3rd Generation" and version " <= FW13"		en		Affected
WAGO Search vendor "WAGO"		Fieldbus Coupler Ethernet 3rd Generation Search vendor "WAGO" for product "Fieldbus Coupler Ethernet 3rd Generation"				<= FW13 Search vendor "WAGO" for product "Fieldbus Coupler Ethernet 3rd Generation" and version " <= FW13"		en		Affected