CVE-2022-36325
Medium
Published: 10 August 2022
Published
10 August 2022
Modified
14 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1
6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS Score
0.0043
63.3th percentile
Risk Priority
14
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2022-36325 is a medium-severity Basic XSS (CWE-80) vulnerability in Siemens Scalance M-800 Firmware. Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 36.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39041
Vulnerability details
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
siemens
scalance m-800 firmware
all versions
siemens
scalance s615 firmware
all versions
siemens
scalance sc-600 firmware
≤ 2.3.1
siemens
scalance sc622-2c firmware
≤ 2.3.1
siemens
scalance sc632-2c firmware
≤ 2.3.1
siemens
scalance sc636-2c firmware
≤ 2.3.1
siemens
scalance sc642-2c firmware
≤ 2.3.1
siemens
scalance sc646-2c firmware
≤ 2.3.1
siemens
scalance w700 ieee 802.11ax firmware
all versions
siemens
scalance w700 ieee 802.11n firmware
all versions
+80 more product configuration(s) — see NVD for full list
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.