CVE-2020-7575— Siemens Climatix POL908和POL909 跨站脚本漏洞

N/A

A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitrary JavaScript code via specially crafted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web sessions.

N/A

Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)

Siemens Climatix POL908和POL909 跨站脚本漏洞

Siemens Climatix是德国西门子（Siemens）公司的一套专为空调、制冷和区域供热OEM研发的标准化和可编程控制解决方案，它提供全面的HVAC组合，可根据特定需求进行扩展。BACnet IP - POL908是其中的一个BACnet IP通信模块。AWM Module - POL909是其中的一个AWM通信模块。 Siemens Climatix POL908（所有版本）和Climatix POL909（所有版本）存在跨站脚本漏洞。攻击者可利用该漏洞注入任意JavaScript代码，影响其他

N/A

N/A