CVE-2022-40190

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

Cross site scripting

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

CVE-2022-40190

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

CVE-2022-40190

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

CVE-2022-40190

SAUTER moduWeb firmware version 2.7.1 is affected by a reflective cross-site scripting (XSS) vulnerability due to insufficient sanitization of request strings. This can allow an attacker to execute malicious JavaScript in a user’s browser and potentially steal credentials or other sensitive data....

PT-2022-25271 · Sauter Controls · Sauter Controls Moduweb

Name of the Vulnerable Software and Affected Versions: SAUTER Controls moduWeb firmware version 2.7.1 Description: The web application does not adequately sanitize request strings of malicious JavaScript, allowing an attacker to execute malicious code in users' browsers and steal sensitive...

SAUTER Controls moduWeb

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: SAUTER Controls Equipment: moduWeb Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to trick users into clicking on malicious...

CISA Releases Four Industrial Control Systems Advisories

CISA has released four 4 Industrial Control Systems ICS advisories on October 27, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisory for...

Fr. Sauter AG CASE Suite XML External Entity Injection Vulnerability

Fr. Sauter AG CASE Suite is a software development kit for building automation systems from Fr. Sauter AG, Switzerland. An XML external entity injection vulnerability exists in Fr. Sauter AG CASE Suite version 3.10 and earlier. A remote attacker could exploit this vulnerability to cause a file...

Design/Logic Flaw

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888

The CVE-2017-17888 entry concerns Anti-Web (up to version 3.8.7) used in multiple industrial/OT devices (NetBiter/HMS, Ouman EH-net, Alliance WS100 → AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, ASCON DY WebServer). Vulnerability: remote authe...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

Apps industrial OT over Server: Anti-Web Remote Command Execution(CVE-2017-17888)

Exploit Title: Apps industrial OT over Server: "Anti-Web 3.x.x 3.8.x" vuln: Remote Command Execution Date: 15/05/2017 Exploit Author: Fernandez Ezequiel @capitanalfa && Bertin Jose @bertinjoseb Vendor: Multiples vendors Category: Industrial OT webapps + DESCRIPTION: vulnerability: RCE REMOTE...

CVE-2016-10224

An issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user...

Design/Logic Flaw

An issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user...

CVE-2016-10224

An issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user...

CVE-2016-10224

The CVE-2016-10224 entry concerns Sauter NovaWeb web HMI where a protection check relies on a cookie’s existence/values but does not verify that the cookie is valid for the associated user. Affected component: the web HMI protection mechanism. Root cause: inadequate validation of user-bound cooki...

Sauter NovaWeb Web HMI Authentication Bypass Vulnerability

Sauter is a leading provider in the building, room automation, energy management and facility management sectors. An authentication bypass vulnerability exists in Sauter NovaWeb Web HMI, which can be exploited by an attacker to bypass security restrictions and perform unauthorized operations...

Sauter moduWeb Vision Vulnerabilities

OVERVIEW Martin Jartelius and John Stock of Outpost24 have identified three vulnerabilities in Sauter’s moduWeb Vision application. Sauter has produced a new firmware version to mitigate these vulnerabilities. The researchers have tested the new firmware version to validate that it resolves the...

The vulnerability of the web server for visualizing BACnet/IP network controllers, SAUTER moduWeb Vision, allows a intruder to bypass the authentication process.

The vulnerability of the BACnet/IP network controller visualization web server from SAUTER moduWeb Vision is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures by utilizing knowledge of password hashes without knowi...