The remote web server appears to be a Modicon Quantum controller vulnerable to a reflected cross-site scripting attack. An attacker can leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected device.

An Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.

ID	Name	Product	Family	Published	Updated	Severity
119147	Modicon Quantum HTTP Server 'formTest' 'name' Parameter XSS	Nessus	SCADA	2018/11/26	2021/01/15	medium
720245	Schneider Electric Modicon Multiple Controllers Cross-Site Scripting	Nessus Network Monitor	SCADA	2019/05/08	2019/09/30	medium

Plugins Search