Read the docs
TI-2022-19049 Aliases CVE-2022-40181GHSA-r9x8-x33r-r8q2

Cross-site scripting in Siemens Desigo PXM30-1

Priority LOW 38CWE-84Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions.

Why it matters now

EPSS 0.01009 63rd percentileScored 2026-11-07
Fix Fixed Desigo PXM30-1 (Siemens): V02.20.126.11-41Desigo PXM30.E (Siemens): V02.20.126.11-41+8 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensDesigo PXM30-1before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM30.Ebefore V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM40-1before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM40.Ebefore V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM50-1before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensDesigo PXM50.Ebefore V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensPXG3.W100-1before V02.20.126.11-37V02.20.126.11-37Patch availableCNA
SiemensPXG3.W100-2before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
SiemensPXG3.W200-1before V02.20.126.11-37V02.20.126.11-37Patch availableCNA
SiemensPXG3.W200-2before V02.20.126.11-41V02.20.126.11-41Patch availableCNA
  • Desigo PXM30-1 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM30.E VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM40-1 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM40.E VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM50-1 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • Desigo PXM50.E VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • PXG3.W100-1 VendorSiemens Affected before V02.20.126.11-37 Fixed in V02.20.126.11-37 Patch available CNA
  • PXG3.W100-2 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA
  • PXG3.W200-1 VendorSiemens Affected before V02.20.126.11-37 Fixed in V02.20.126.11-37 Patch available CNA
  • PXG3.W200-2 VendorSiemens Affected before V02.20.126.11-41 Fixed in V02.20.126.11-41 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:o:siemens:desigo_pxm30-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm30-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm30.e_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm30.e:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm40-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm40-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm40.e_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm40.e:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:desigo_pxm50-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm50-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:desigo_pxm30-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm30-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm30.e_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm30.e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm40-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm40-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm40.e_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm40.e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:desigo_pxm50-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm50-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:siemens:desigo_pxm50.e_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:desigo_pxm50.e:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w100-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-37VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w100-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w100-2_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w100-2:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w200-1_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-37VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w200-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:pxg3.w200-2_firmware:*:*:*:*:*:*:*:*before 02.20.126.11-41VulnerableSiemens
cpe:2.3:h:siemens:pxg3.w200-2:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:desigo_pxm50.e_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:desigo_pxm50.e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w100-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-37 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w100-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w100-2_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w100-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w200-1_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-37 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w200-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:pxg3.w200-2_firmware:*:*:*:*:*:*:*:* Versions before 02.20.126.11-41 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:pxg3.w200-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA Desigo PXM30-1 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM30.E (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM40-1 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM40.E (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM50-1 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA Desigo PXM50.E (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA PXG3.W100-1 (Siemens) Fixed in V02.20.126.11-37
  • Fix · CNA PXG3.W100-2 (Siemens) Fixed in V02.20.126.11-41
  • Fix · CNA PXG3.W200-1 (Siemens) Fixed in V02.20.126.11-37
  • Fix · CNA PXG3.W200-2 (Siemens) Fixed in V02.20.126.11-41

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40181
  2. 2026-10-03 Alias added: GHSA-r9x8-x33r-r8q2

References

Patch 1

  • TI-2022-19050 A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41)… CVSS 3.1HIGH 8.8
  • TI-2022-19044 OS command injection in Siemens Desigo PXM30-1 CVSS 3.1HIGH 8.0
  • TI-2022-19047 Cross-site request forgery in Siemens Desigo PXM30-1 CVSS 3.1HIGH 8.1
  • TI-2022-19045 Information disclosure in Siemens Desigo PXM30-1 CVSS 3.1MEDIUM 5.7
  • TI-2022-19046 Cross-site scripting in Siemens Desigo PXM30-1 CVSS 3.1MEDIUM 5.4
  • TI-2022-19048 Cross-site request forgery in Siemens Desigo PXM30-1 CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences