CVE-2021-41541

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Siemens	Climatix POL909 (AWB module)	All versions < V11.44
Siemens	Climatix POL909 (AWM module)	All versions < V11.36

References

https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdfPatch, Vendor Advisory

Timeline

Published: Mar 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415426.1A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1 CVE-2021-415436.5A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1 CVE-2021-415447.8A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability could allow a local atta CVE-2021-415457.5A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PX CVE-2021-415467.5A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDC CVE-2021-415477.2A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All vers CVE-2021-41555.5A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A CVE-2021-415507.2Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.CVE-2021-415514.9Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a s CVE-2021-415528.8CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.CVE-2021-415539.8In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be a CVE-2021-415548.8ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affe