{"id":"CVE-2022-46350","aliases":["EUVD-2022-49166","GHSA-7c94-jfmg-hjhf"],"status":"published","title":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE...","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00475,"percentile":0.4139,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79","CWE-80"],"published":"2022-12-13T00:00:00Z","modified":"2026-06-17T05:11:35Z","products":[{"vendor":"siemens","product":"6gk5204-0ba00-2kb2_firmware"},{"vendor":"siemens","product":"6gk5204-0ba00-2mb2_firmware"},{"vendor":"siemens","product":"6gk5204-0bs00-2na3_firmware"},{"vendor":"siemens","product":"6gk5204-0bs00-3la3_firmware"},{"vendor":"siemens","product":"6gk5204-0bs00-3pa3_firmware"},{"vendor":"siemens","product":"scalance x204rna (hsr)"},{"vendor":"siemens","product":"scalance x204rna (prp)"},{"vendor":"siemens","product":"scalance x204rna eec (hsr)"},{"vendor":"siemens","product":"scalance x204rna eec (prp)"},{"vendor":"siemens","product":"scalance x204rna eec (prp/hsr)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46350"},{"url":"https://github.com/advisories/GHSA-7c94-jfmg-hjhf"}],"sources":{"cve":[{"id":"CVE-2022-46350","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-22T03:03:40.51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:34:31.840191Z"}],"euvd":[{"id":"EUVD-2022-49166","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-22T03:03:40Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:17.705566Z"}],"ghsa":[{"id":"GHSA-7c94-jfmg-hjhf","title":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE...","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.","status":"published","published":"2022-12-13T18:30:34Z","modified":"2025-04-22T03:30:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:01:59.076415Z"}],"nvd":[{"id":"CVE-2022-46350","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.","status":"published","published":"2022-12-13T16:15:25.667Z","modified":"2026-06-17T05:11:35.4Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-80","CWE-79"],"updated_at":"2026-11-02T14:07:33.649381Z"}]}}