attack vector is network; attack complexity is high; privileges required is none; user interaction is required; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Siemens Industrial Edge App Publisher
Classified as
CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
Industrial Edge App Publisher
Subsystems
General OT
Sectors
Multiple
What to Know
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine (NVD)
What to Do
Monitor Siemens's web page for any future patch releases.