Siemens Security Slip: Cross-Site Scripting Chaos in OZW Web Servers!
Siemens’ OZW672 and OZW772 web servers are vulnerable to cross-site scripting (XSS) attacks. An attacker’s JavaScript could run with higher privileges. Update to version 5.2 or later to dodge this cyber booby trap. For more details, refer to Siemens ProductCERT Security Advisories.
Hot Take:
Siemens’ web servers are learning how to code JavaScript, but not in the good way. With CISA stepping back from constant babysitting, it’s time for Siemens to brush up on their babysitting skills for their own products. Who knew web servers had a knack for mischief?
Key Points:
- CISA will halt continuous updates for Siemens ICS security advisories after initial notice.
- Siemens’ OZW672 and OZW772 web servers are vulnerable to cross-site scripting (XSS).
- Successful exploitation allows a remote attacker to inject JavaScript, affecting other users.
- Mitigation includes updating to version V5.2 or later and following Siemens’ security guidelines.
- No known public exploitation of this vulnerability has been reported to CISA.
Already a member? Log in here