Paper/Archive/CVE-2022-40190

CVE-2022-40190

SAUTER Controls moduWeb — SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS).

EPSS 0.9%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 58.2.582 × 2011.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive information, including user credentials.

Affected

ProductAffectedFixed inSource

moduWebfirmware Version 2.7.1–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

icscert (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-300-02