Description


The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).

References


https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01

Third Party AdvisoryUS Government Resource

Weaknesses



NVD-CWE-Other


CWE-94

CVSS impact metrics


CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information


Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-03-10T17:46:38.743

3 years ago

Last modified

2023-06-23T20:25:06.257

2 years ago