Siemens created an update to mitigate a cross-site scripting vulnerability in its SCALANCE X switches, according to a report with NCCIC.
Successful exploitation of these cross-site scripting vulnerabilities, discovered by Marius Rothenbücher and Ali Abbasi, could allow an attacker to store script code on the website and execute cross-site scripting (XSS), affecting the website’s confidentiality, integrity, and availability. However, no known public exploits specifically target these remotely exploitable vulnerabilities. High skill level is needed to exploit.
The vulnerabilities affect the following SCALANCE X switches:
• SCALANCE X-200: All versions prior to v5.2.3 (only affected by CVE-2018-4848)
• SCALANCE X-200 IRT: All versions prior to v5.4.1
• SCALANCE X300: All versions
In the vulnerability, a remote, authenticated attacker with access to the configuration web server could store script code on the website, provided the HRP redundancy option is set. This code could be executed in the web browser of users visiting this website (XSS), affecting its confidentiality, integrity, and availability.
User interaction is required for successful exploitation as the user needs to visit the manipulated website.
CVE-2018-4842 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 5.5.
In addition, the integrated configuration web server of the affected Scalance X Switches could allow XSS attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.
CVE-2018-4848 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 5.8.
The products see use mainly in the chemical, energy, food and agriculture, healthcare and public health, transportation systems, and water and wastewater systems sectors. They also see action on a global basis.
No known public exploits specifically target these vulnerabilities. High skill level is needed to exploit.
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for Industrial Security https://www.siemens.com/cert/operational-guidelines-industrial-security
Click here for additional information on industrial security by Siemens.
For more information on these vulnerabilities and associated software updates, see Siemens security advisory SSA-480829.