CyberSecBulletin
CVE-2022-24039NVD status: Modified

Desigo PXC4: Failure to Sanitize Special Elements into a Different Plane

Published Updated By the CyberSecBulletin desk

CVE-2022-24039 is a critical-severity failure to sanitize special elements into a different plane vulnerability in Desigo PXC4 from Siemens, with a CVSS 3.1 base score of 9.0 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, but only if a user takes part, for example by opening a link or file. Affected Desigo PXC4 versions: All versions < V02.20.142.10-10884. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 2.03% chance of exploitation within 30 days, higher than 81% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Desigo Pxc5 Firmware to 02.20.142.10-10884 or a later version.
  2. Update Desigo Pxc4 Firmware to 02.20.142.10-10884 or a later version.
  3. Read the advisory on cert-portal.siemens.com for workarounds and exact fixed builds.
  4. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensDesigo PXC4All versions < V02.20.142.10-10884Not stated
SiemensDesigo PXC5All versions < V02.20.142.10-10884Not stated
SiemensDesigo Pxc5 Firmwarebefore 02.20.142.10-1088402.20.142.10-10884
SiemensDesigo Pxc4 Firmwarebefore 02.20.142.10-1088402.20.142.10-10884

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.0CriticalNVD
CVSS 2.08.5HighNVD

Official description

A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such that it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges, by poisoning any of the content used to generate XLS reports, could be able to leverage the application to deliver malicious files against higher-privileged users and obtain Remote Code Execution (RCE) against the administrator’s workstation.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Failure to Sanitize Special Elements into a Different Plane

The product does not adequately filter user-controlled input for special elements with control implications.

How developers prevent this class of flaw

  • Programming languages and supporting technologies might be chosen which are not subject to these issues.
  • Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

More Failure to Sanitize Special Elements into a Different Plane vulnerabilities (CWE-75)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Desigo PXC4

All Desigo PXC4 vulnerabilities

Spotted an error? Tell us.