CVE-2018-25090
Medium
Description
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.
SeverityMedium
CVSS5.4
Exploit probability—
ProductController BACnet/IP
PublishedMar 13, 2024
First seenMar 13, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WAGO Controller BACnet/IP | v ≤ FW13 | — |
| WAGO Controller BACnet MS/TP | v ≤ FW13 | — |
| WAGO Ethernet Controller 3rd Generation | v ≤ FW13 | — |
| WAGO Fieldbus Coupler Ethernet 3rd Generation | v ≤ FW13 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.