Description
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Controller BACnet/IP | ≤ FW13 | — |
| WAGO | Controller BACnet MS/TP | ≤ FW13 | — |
| WAGO | Ethernet Controller 3rd Generation | ≤ FW13 | — |
| WAGO | Fieldbus Coupler Ethernet 3rd Generation | ≤ FW13 | — |
Advisories 1
- VDE-2023-039 Wago: Multiple vulnerabilities in web-based management of multiple products CERT@VDE · Mar 13, 2024