CVE:CVE-2022-40181
CNNVD:CNNVD-202210-506
Siemens Desigo PX是德国西门子（Siemens）公司的一套楼宇自动化控制系统。
Siemens 多款产品存在安全漏洞，该漏洞源于当 Web 应用程序代码重定向到相应的资源时，设备嵌入式浏览器不会阻止与替代 URI 方案的交互。通过设置主页 URI、收藏 URI 或通过 JavaScript 代码将嵌入式浏览器用户重定向到替代方案资源，远程低权限攻击者可以对设备执行一系列攻击，例如读取文件系统上的任意文件、执行任意 JavaScript代码以窃取或操纵屏幕上的信息，或触发拒绝服务条件。Desigo PXM30-1 V02.20.126.11-41 版本之前，Desigo PXM30.E V02.20.126.11-41 版本之前，Desigo PXM40-1 V02.20.126.11-41 版本之前，Desigo PXM40.E V02.20.126.11-41 版本之前，Desigo PXM50-1 V02.20.126.11-41 版本之前，Desigo PXM50.E V02.20.126.11-41 版本之前，PXG3.W100-1 V02.20.126.11-37 版本之前，PXG3.W100-2 V02.20.126.11-41 版本之前，PXG3.W200-1 V02.20.126.11-37 版本之前，PXG3.W200-2 V02.20.126.11-41 版本之前。
solution:Upgrade siemens desigo_pxm30-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm30.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w100-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w100-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w200-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w200-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41)