CVE-2018-25090 — Wago: Improper Neutralization of Input During Web Page Generation in multiple devices

Description (CNA)

An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.

Affected (CNA)

Vendor / product	Versions
WAGO / Controller BACnet/IP	affected 0 through FW13
WAGO / Controller BACnet MS/TP	affected 0 through FW13
WAGO / Ethernet Controller 3rd Generation	affected 0 through FW13
WAGO / Ethernet Controller 3rd Generation	affected 0 through FW13
WAGO / Fieldbus Coupler Ethernet 3rd Generation	affected 0 through FW13

CWE

CWE-79

References

https://cert.vde.com/en/advisories/VDE-2023-039/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2023-039/

CISA-ADP

No English description supplied.

No references supplied.