Description
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Climatix POL909 (AWB module) | All versions < V11.44 | — |
| Siemens | Climatix POL909 (AWM module) | All versions < V11.36 | — |
Advisories 2
- ICSA-22-069-07 Siemens Climatix POL909 CISA ICS & IT advisories · May 6, 2025
- SSA-252466 SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) Siemens ProductCERT · Mar 8, 2022