CVE-2019-6835
Medium
Description
A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an attacker to inject client-side script when a user visits a web page.
SeverityMedium
CVSS5.4
Exploit probability—
ProductSchneider-electric Meg6501-0001 Firmware
PublishedSep 17, 2019
First seenSep 17, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- schneider-electric meg6501-0001_firmware1.3.7 or later
- schneider-electric meg6501-0002_firmware1.3.7 or later
- schneider-electric meg6260-0410_firmware1.3.7 or later
- schneider-electric meg6260-0415_firmware1.3.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric meg6501-0001_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6501-0002_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6260-0410_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6260-0415_firmware | v < 1.3.7 | 1.3.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.