Read the docs
TI-2022-19047 Aliases CVE-2022-40179GHSA-g7x8-fww2-5qqg

Cross-site request forgery in Siemens Desigo PXM30-1

Priority LOW 35CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). A Cross-Site Request Forgery exists in endpoints of the “Operation” web application that interpret and execute Axon language queries, due to the missing validation of anti-CSRF tokens or other origin checks. By convincing a victim to click on a malicious link or visit a specifically crafted webpage while logged-in to the device web application, a remote unauthenticated attacker can execute arbitrary Axon queries against the device.

Why it matters now

EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed Desigo PXM30-1 (Siemens): V02.20.126.11-41Desigo PXM30.E (Siemens): V02.20.126.11-41+8 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensDesigo PXM30-1before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM30.Ebefore V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM40-1before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM40.Ebefore V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM50-1before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM50.Ebefore V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensPXG3.W100-1before V02.20.126.11-37V02.20.126.11-37Patch availableCNA
SiemensPXG3.W100-2before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensPXG3.W200-1before V02.20.126.11-37V02.20.126.11-37Patch availableCNA
SiemensPXG3.W200-2before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
  • Desigo PXM30-1 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM30.E VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM40-1 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM40.E VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM50-1 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM50.E VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • PXG3.W100-1 VendorSiemens Affected before V02.20.126.11-37 Fixed in V02.20.126.11-37 Patch available CNA
  • PXG3.W100-2 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • PXG3.W200-1 VendorSiemens Affected before V02.20.126.11-37 Fixed in V02.20.126.11-37 Patch available CNA
  • PXG3.W200-2 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:o:siemens:desigo_pxm30-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm30-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm30.e_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm30.e:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm40-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm40-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm40.e_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm40.e:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm50-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm50-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:desigo_pxm30-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm30-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm30.e_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm30.e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm40-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm40-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm40.e_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm40.e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm50-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm50-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:siemens:desigo_pxm50.e_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm50.e:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w100-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-37VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w100-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w100-2_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w100-2:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w200-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-37VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w200-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w200-2_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w200-2:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:desigo_pxm50.e_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm50.e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w100-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-37 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w100-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w100-2_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w100-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w200-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-37 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w200-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w200-2_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w200-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA Desigo PXM30-1 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM30.E (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM40-1 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM40.E (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM50-1 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM50.E (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA PXG3.W100-1 (Siemens) Fixed in V02.20.126.11-37
  • Fix · CNA PXG3.W100-2 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA PXG3.W200-1 (Siemens) Fixed in V02.20.126.11-37
  • Fix · CNA PXG3.W200-2 (Siemens) Fixed in V02.20.126.11-41

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40179
  2. 2026-10-03 Alias added: GHSA-g7x8-fww2-5qqg

References

Patch 1

  • TI-2022-19050 A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41)… CVSS 3.1HIGH 8.8
  • TI-2022-19049 Cross-site scripting in Siemens Desigo PXM30-1 CVSS 3.1HIGH 8.3
  • TI-2022-19044 OS command injection in Siemens Desigo PXM30-1 CVSS 3.1HIGH 8.0
  • TI-2022-19045 Information disclosure in Siemens Desigo PXM30-1 CVSS 3.1MEDIUM 5.7
  • TI-2022-19046 Cross-site scripting in Siemens Desigo PXM30-1 CVSS 3.1MEDIUM 5.4
  • TI-2022-19048 Cross-site request forgery in Siemens Desigo PXM30-1 CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences