CVE-2022-43376

Published: Apr 18, 2023Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)

Affected (5)

Products: Schneider Electric: Netbotz 355 Firmware, Netbotz 450 Firmware, Netbotz 455 Firmware, Netbotz 550 Firmware, Netbotz 570 Firmware

5 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Netbotz 355 Firmware	From 4.0.0 to 4.7.0

Running on/with	Platform Versions
Schneider Electric Netbotz 355	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Netbotz 450 Firmware	From 4.0.0 to 4.7.0

Running on/with	Platform Versions
Schneider Electric Netbotz 450	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Netbotz 455 Firmware	From 4.0.0 to 4.7.0

Running on/with	Platform Versions
Schneider Electric Netbotz 455	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Netbotz 550 Firmware	From 4.0.0 to 4.7.0

Running on/with	Platform Versions
Schneider Electric Netbotz 550	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Netbotz 570 Firmware	From 4.0.0 to 4.7.0

Running on/with	Platform Versions
Schneider Electric Netbotz 570	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf

Source: cybersecurity@se.com

PatchVendor Advisory

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.