CVE-2017-12738

MEDIUM

Siemens SICAM RTUs SM-2556 COM Modules - Cross-Site Scripting via Integrated Web Server

Title source: llm

Description

An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into clicking on a malicious link.

References (2)

Core 2

Core References

Mitigation, Vendor Advisory x_refsource_confirm

https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/101884

Scores

CVSS v3 6.1

EPSS 0.0022

EPSS Percentile 44.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (7)

n/a/Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00 Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi

siemens/sm-2556_firmware dnpi00

siemens/sm-2556_firmware enos00

siemens/sm-2556_firmware erac00

siemens/sm-2556_firmware eta2

siemens/sm-2556_firmware etls00

siemens/sm-2556_firmware modi00

Published Nov 15, 2017

Tracked Since Feb 18, 2026