Medium severity · published Jul 25, 2024
CVE-2024-6558
HMS Industrial Networks Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
HMS Industrial Networks
Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is possible to insert HTML code into input fields and store the HTML code. The stored HTML code will be embedded in the page and executed by host browser the next time the page is loaded, enabling social engineering attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Anybus Compactcom 30 Module Ethernet/ip Firmware · Hms-networks
All versions, or not specified · source: NVD
AC
Anybus Compactcom 30 Module Usb Without Housing Firmware · Hms-networks
All versions, or not specified · source: NVD
Affected product
AC
Anybus Compactcom 30 Module Ethernet/ip Firmware
Hms-networks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6558
Mitigation
https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-05-17-001---anybus---compactcom-30-xss.pdf
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-20
