PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36140 Siemens CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the user accounts tab of Siemens OZW672 and OZW772 Web Server devices. An authenticated remote attacker can inject arbitrary JavaScript code that executes when another authenticated user—potentially with higher privileges—views the affected page. The vulnerability was disclosed on November 12, 2024, with a revision on May 6, 2025, to correct typos. Siemens has released firmware version 5.2 or later to address this issue. The CVSS 3.1 score of 6.8 reflects network attack vector, low attack complexity, required low privileges, and high integrity impact with user interaction needed.

Vendor
Siemens
Product
OZW672
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-12
Original CVE updated
2025-05-06
Advisory published
2024-11-12
Advisory updated
2025-05-06

Who should care

Organizations operating Siemens OZW672 or OZW772 Web Server devices for building automation or HVAC control systems; industrial control system administrators responsible for web-based device management; security teams monitoring for authenticated attack chains in OT environments.

Technical summary

The user accounts management interface in Siemens OZW672 and OZW772 Web Server devices fails to properly sanitize input, allowing stored XSS attacks. An authenticated attacker with low privileges can persist malicious JavaScript in account fields. When a victim with potentially elevated privileges accesses the user accounts tab, the injected script executes in their browser context. This enables session hijacking, privilege escalation, or unauthorized administrative actions. The attack requires network access to the web interface and user interaction from the victim.

Defensive priority

medium

Recommended defensive actions

  • Apply Siemens firmware update to version 5.2 or later for affected OZW672 and OZW772 devices
  • Review user account configurations for unauthorized modifications or injected content
  • Implement principle of least privilege for web server administrative accounts
  • Consider network segmentation to limit exposure of web management interfaces
  • Monitor for anomalous authentication patterns or unexpected administrative actions

Evidence notes

The vulnerability description and remediation guidance are derived from CISA CSAF advisory ICSA-24-319-03, which references Siemens security advisory SSA-230445. The affected products are confirmed as OZW672 and OZW772 Web Server devices. The fix version is explicitly stated as V5.2 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36140 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36140

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36140 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36140

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-230445.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-230445.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.