Description
A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks.
This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | OZW672 | < V5.2 | V5.2 |
| Siemens | OZW772 | < V5.2 | V5.2 |
Advisories 3
- ICSA-24-319-03 Siemens OZW672 and OZW772 Web Server CISA ICS & IT advisories · May 6, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- SSA-230445 SSA-230445: Stored XSS Vulnerability in OZW Web Servers Before V5.2 Siemens ProductCERT · Nov 12, 2024