Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-7574

Quick assessment

Affected
Siemens Climatix POL908 (BACnet/IP module)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Siemens Climatix是德国西门子（Siemens）公司的一套专为空调、制冷和区域供热OEM研发的标准化和可编程控制解决方案，它提供全面的HVAC组合，可根据特定需求进行扩展。BACnet IP - POL908是其中的一个BACnet IP通信模块。AWM Module - POL909是其中的一个AWM通信模块。 Siemens Climatix POL908（所有版本）和Climatix POL909（所有版本）中的Server Config界面存在跨站脚本漏洞。攻击者可利用该漏洞注入任意

AI Predicted 5.4 Difficulty: Easy EPSS 0.66% · P50
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-7574

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the "Server Config" web interface of the affected devices that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web session.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Siemens Climatix POL908和POL909 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Siemens Climatix是德国西门子（Siemens）公司的一套专为空调、制冷和区域供热OEM研发的标准化和可编程控制解决方案，它提供全面的HVAC组合，可根据特定需求进行扩展。BACnet IP - POL908是其中的一个BACnet IP通信模块。AWM Module - POL909是其中的一个AWM通信模块。 Siemens Climatix POL908（所有版本）和Climatix POL909（所有版本）中的Server Config界面存在跨站脚本漏洞。攻击者可利用该漏洞注入任意
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Siemens Climatix POL908 (BACnet/IP module) All versions -
Siemens Climatix POL909 (AWM module) All versions < V11.32 -

II. Public POCs for CVE-2020-7574

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-7574

请登录查看更多情报信息。

Vendor Advisories for CVE-2020-7574 (1)

Same Patch Batch · Siemens · 2020-04-14 · 4 CVEs total

CVE-2019-19301 7.5 HIGH Siemens SCALANCE X-200IRT 资源管理错误漏洞
CVE-2019-19300 7.5 HIGH 多款Siemens产品 资源管理错误漏洞
CVE-2020-7575 Siemens Climatix POL908和POL909 跨站脚本漏洞

IV. Related Vulnerabilities

Same product: Climatix POL908 (BACnet/IP module)
Same vendor: Siemens
Same weakness: CWE-79

V. Comments for CVE-2020-7574

No comments yet

Leave a comment