PT-2022-25271 · Sauter Controls · Sauter Controls Moduweb

Ithaca Labs · Published 2022-10-31 · Updated 2022-11-02 · CVE-2022-40190

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAUTER Controls moduWeb firmware version 2.7.1

Description The web application does not adequately sanitize request strings of malicious JavaScript, allowing an attacker to execute malicious code in users' browsers and steal sensitive information, including user credentials, through reflective cross-site scripting (XSS).

Recommendations For SAUTER Controls moduWeb firmware version 2.7.1, consider disabling the web application's ability to execute JavaScript code from request strings until a patch is available. Restrict access to the web application to minimize the risk of exploitation. Avoid using the web application for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40190

Affected Products

Sauter Controls Moduweb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-40190 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40190 · Vendor Advisory
• https://t.me/cibsecurity/52325 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-300-02 · Note