CVE-2016-1488

EUVD-2016-2587
Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Affected Products (NVD)
VendorProductVersion
siemensozw672_firmware
𝑥
≤ 5.2
siemensozw772_firmware
𝑥
≤ 5.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdf
https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdf
https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01