An Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.

The remote web server appears to be a Modicon Quantum controller vulnerable to a reflected cross-site scripting attack. An attacker can leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected device.

ID	Name	Product	Family	Published	Updated	Severity
720245	Schneider Electric Modicon Multiple Controllers Cross-Site Scripting	Nessus Network Monitor	SCADA	2019/05/08	2019/09/30	medium
119147	Modicon Quantum HTTP Server 'formTest' 'name' Parameter XSS	Nessus	SCADA	2018/11/26	2020/09/14	medium

Plugins Search