A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded Chromium-based browser is launched as root with the “--no-sandbox” option. Attackers can add arbitrary JavaScript code inside “Operation” graphics and successfully exploit any number of publicly known vulnerabilities against the version of the embedded Chromium-based browser.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
History
12 Oct 2022, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:o:siemens:desigo_pxm50-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:pxg3.w100-1:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:desigo_pxm50-1:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:pxg3.w200-2:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:pxg3.w200-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:desigo_pxm30.e:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:desigo_pxm30-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:desigo_pxm40.e_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:desigo_pxm30-1:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:pxg3.w100-2:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:pxg3.w100-2_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:desigo_pxm30.e_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:pxg3.w100-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:pxg3.w200-1:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:desigo_pxm40-1:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:desigo_pxm50.e:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:desigo_pxm40.e:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:desigo_pxm50.e_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:desigo_pxm40-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:pxg3.w200-2_firmware:*:*:*:*:*:*:*:* |
|
| First Time |
Siemens desigo Pxm40.e
Siemens desigo Pxm50-1 Siemens desigo Pxm30.e Firmware Siemens pxg3.w100-1 Firmware Siemens desigo Pxm40.e Firmware Siemens pxg3.w200-1 Siemens pxg3.w200-2 Siemens desigo Pxm50.e Firmware Siemens desigo Pxm50-1 Firmware Siemens pxg3.w200-2 Firmware Siemens pxg3.w100-2 Siemens desigo Pxm30-1 Firmware Siemens desigo Pxm30.e Siemens desigo Pxm30-1 Siemens desigo Pxm40-1 Firmware Siemens desigo Pxm40-1 Siemens pxg3.w200-1 Firmware Siemens pxg3.w100-2 Firmware Siemens desigo Pxm50.e Siemens pxg3.w100-1 Siemens |
|
| References | (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf - Patch, Vendor Advisory |
11 Oct 2022, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-11 11:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-40182
Mitre link : CVE-2022-40182
CVE.ORG link : CVE-2022-40182
JSON object : View
Products Affected
siemens
- desigo_pxm50-1_firmware
- pxg3.w100-1
- desigo_pxm40.e
- pxg3.w200-1_firmware
- pxg3.w200-2
- desigo_pxm30-1_firmware
- desigo_pxm30.e
- desigo_pxm40-1_firmware
- desigo_pxm30.e_firmware
- desigo_pxm50.e
- desigo_pxm30-1
- pxg3.w100-2
- pxg3.w100-1_firmware
- desigo_pxm40.e_firmware
- pxg3.w100-2_firmware
- desigo_pxm40-1
- desigo_pxm50.e_firmware
- pxg3.w200-1
- desigo_pxm50-1
- pxg3.w200-2_firmware
CWE
CWE-250
Execution with Unnecessary Privileges