CVE-2024-6528

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cybersecurity@se.com

Published

2024-07-11

Last modified

2024-08-01

Weaknesses

CWE-79

Affected products

• Modicon Lmc058 Firmware (Schneider-electric)
• Modicon M241 Firmware (Schneider-electric)
• Modicon M251 Firmware (Schneider-electric)
• Modicon M258 Firmware (Schneider-electric)
• Modicon M262 Firmware (Schneider-electric)
• Modicon Controllers M241 M251 (Schneider Electric)
• Modicon Controllers M258 Lmc058 (Schneider Electric)
• Modicon Controllers M262 (Schneider Electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-04&p_enDocType=Security+and+Safety+Notice&p_File_…