PT-2020-19631 · Siemens · Climatix Pol909+1

Published 2020-04-14 · Updated 2021-03-04 · CVE-2020-7574

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Climatix POL908 (BACnet/IP module) (All versions) Climatix POL909 (AWM module) versions prior to V11.32

Description A persistent cross-site scripting (XSS) issue exists in the "Server Config" web interface, allowing an attacker to inject arbitrary JavaScript code. This code could be executed later by another user, potentially compromising the confidentiality and integrity of their web session. The issue can be exploited by an attacker with network access, and no system privileges are required.

Recommendations For Climatix POL908 (BACnet/IP module), at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Climatix POL909 (AWM module) versions prior to V11.32, update to version V11.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Server Config" web interface until a patch is available.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-7574

Affected Products

Climatix Pol908

Climatix Pol909

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-7574 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7574 · Vendor Advisory