CVE-2022-36325 Siemens CVE debrief

Who should care

Administrators and operators of affected Siemens SCALANCE devices, OT/ICS security teams, and network teams that use the device web interface for management. Organizations that allow privileged web-based administration should treat this as relevant because exploitation requires administrative access and user interaction.

Technical summary

The advisory states that affected devices do not properly sanitize user-supplied data when rendering the web interface. That creates a DOM-based cross-site scripting condition in which attacker-controlled content can be interpreted by the browser as script in the management UI. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C, indicating network reachability, high privileges required, user interaction required, and high potential impact.

Defensive priority

Medium priority overall, with higher urgency if the device web interface is exposed beyond a tightly controlled admin network or if privileged browser-based administration is common in your environment.

Recommended defensive actions

• Update affected devices to V6.6.0 or later, as directed by Siemens.
• Confirm whether any deployed devices match the affected SCALANCE models and firmware range in the advisory.
• Restrict web management access to trusted administrative networks and least-privilege accounts.
• Apply ICS defense-in-depth and segmentation guidance from CISA recommended practices.
• Review management workflows for unnecessary user interaction with privileged web pages until remediation is complete.

Evidence notes

The source corpus states: improper sanitization of user-introduced data in the web interface can allow an authenticated remote attacker with administrative privileges to inject code and cause DOM-based XSS. The advisory is CISA ICSA-26-111-07, republished from Siemens ProductCERT SSA-019200, with publishedAt 2026-04-14 and modifiedAt 2026-04-21. The supplied CVSS vector includes PR:H and UI:R, supporting the need for administrative privileges and user interaction. Remediation in the corpus is V6.6.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.