PT-2024-8723 · Ozw772+1 · Ozw772+1

Paulo Mota · Published 2024-11-12 · Updated 2024-11-15 · CVE-2024-36140

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions OZW672 versions prior to V5.2 OZW772 versions prior to V5.2

Description The issue is related to the lack of protection for the web page structure in the affected devices, allowing for stored cross-site scripting (XSS) attacks. This could enable an authenticated remote attacker to inject arbitrary JavaScript code, which would be executed by another authenticated user with potentially higher privileges. The user accounts tab of the affected devices is specifically vulnerable to such attacks.

Recommendations For OZW672 versions prior to V5.2, update to version V5.2 or later to resolve the issue. For OZW772 versions prior to V5.2, update to version V5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the user accounts tab until a patch is available. Avoid using the user accounts tab in the affected devices until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-10326

CVE-2024-36140

Affected Products

Ozw672

Ozw772

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-36140 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-230445.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10326 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36140 · Vendor Advisory
• https://twitter.com/CVEnew/status/1856321760024506781 · Twitter Post