{"id":"CVE-2022-40190","state":"PUBLISHED","title":"SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web application does not adequately sanitize request strings of malicious","description":"SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive information, including user credentials.","publishedAt":"2022-10-31T20:14:59.780Z","updatedAt":"2025-04-16T17:43:26.696Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["SAUTER Controls moduWeb"],"affected":[{"vendor":"SAUTER Controls","product":"moduWeb","versions":[{"version":"firmware Version 2.7.1","status":"affected"}]}],"references":["https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-02"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:50:35.280Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/40xxx/CVE-2022-40190.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-40190","state":"PUBLISHED","datePublished":"2022-10-31T20:14:59.780Z","dateUpdated":"2025-04-16T17:43:26.696Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2022-09-29T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive information, including user credentials."}],"affected":[{"vendor":"SAUTER Controls","product":"moduWeb","versions":[{"version":"firmware Version 2.7.1","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-02"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Cross-site Scripting (XSS)"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2022-10-31T00:00:00.000Z"},"datePublic":"2022-10-27T00:00:00.000Z","credits":[{"lang":"en","value":"Ithaca Labs of Odyssey Cyber Security reported this vulnerability."}],"x_generator":{"engine":"Vulnogram 0.0.9"},"source":{"discovery":"UNKNOWN"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-02","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T12:14:39.857Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-16T17:26:09.761346Z","id":"CVE-2022-40190","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-16T17:43:26.696Z"}}]}}}