| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| SIMA² Master Station | all versions |
A reflected cross-site scripting vulnerability exists in the System Diagnostics Manager (SDM) component of SIMA² Master Stations.
A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.
Please consult the CVE details.
Mitigation
Do not use Hyperlinks provided by untrusted 3rd party to access the SIMA² System Diagnostics Manager. Hyperlinks may be provided via:
• Emails from unknown users
• Social media channels
• Messaging services
• Webpages with comment functionality
• QR Codes
The use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.
Remediation
none
CERT@VDE coordinated with AUMA.