CVE-2022-40180

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). A Cross-Site Request Forgery exists in the “Import Files“ functionality of the “Operation” web application due to the missing validation of anti-CSRF tokens or other origin checks. A remote unauthenticated attacker can upload and enable permanent arbitrary JavaScript code into the device just by convincing a victim to visit a specifically crafted webpage while logged-in to the device web application.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Siemens	Desigo PXM30-1	All versions < V02.20.126.11-41
Siemens	Desigo PXM30.E	All versions < V02.20.126.11-41
Siemens	Desigo PXM40-1	All versions < V02.20.126.11-41
Siemens	Desigo PXM40.E	All versions < V02.20.126.11-41
Siemens	Desigo PXM50-1	All versions < V02.20.126.11-41
Siemens	Desigo PXM50.E	All versions < V02.20.126.11-41
Siemens	PXG3.W100-1	All versions < V02.20.126.11-37
Siemens	PXG3.W100-2	All versions < V02.20.126.11-41
Siemens	PXG3.W200-1	All versions < V02.20.126.11-37
Siemens	PXG3.W200-2	All versions < V02.20.126.11-41

References

https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdfPatch, Vendor Advisory

Timeline

Published: Oct 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-401818.3A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D CVE-2022-401828.8A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D CVE-2022-401834.7An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An att CVE-2022-401844.8Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an at CVE-2022-401869.1An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a CVE-2022-401878.0Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port CVE-2022-401887.5Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During CVE-2022-401899.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apa CVE-2022-40196.5A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large req CVE-2022-401909.6SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web application does not adequate CVE-2022-401915.4Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at W CVE-2022-401928.8Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.