ics-cert.us-cert.gov
http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01 CVE-2014-2370
Omron NS Series HMI Improper Neutralization of Input During Web Page Generation
Record summary
CVE-2014-2370 has a selected CVSS score of 4.0.
Description
Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
Description source: CVE List
Affected products and versions
5| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | 8.1xx to < 8.68x | affected |
Default status: unaffected | CVE List | 8.1xx to < 8.68x | affected |
Default status: unaffected | CVE List | 8.1xx to < 8.68x | affected |
Default status: unaffected | CVE List | 8.1xx to < 8.68x | affected |
Default status: unaffected | CVE List | 8.1xx to < 8.68x | affected |
References
568836vdb entry
http://www.securityfocus.com/bid/68836 automation.omron.com
https://automation.omron.com/en/us/products nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2014-2370 cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01