CVE:CVE-2022-40180
CNNVD:CNNVD-202210-505
Siemens Desigo PX是德国西门子（Siemens）公司的一套楼宇自动化控制系统。
Siemens 多款产品存在跨站请求伪造漏洞，该漏洞源于由于缺少对反 CSRF 令牌或其他来源检查的验证，“Operation” Web 应用程序的 Import Files 功能中存在跨站点请求伪造。远程未经身份验证的攻击者只需说服受害者在登录设备 Web 应用程序时访问特制网页，即可将永久任意 JavaScript 代码上传并启用设备。Desigo PXM30-1 V02.20.126.11-41 版本之前，Desigo PXM30.E V02.20.126.11-41 版本之前，Desigo PXM40-1 V02.20.126.11-41 版本之前，Desigo PXM40.E V02.20.126.11-41 版本之前，Desigo PXM50-1 V02.20.126.11-41 版本之前，Desigo PXM50.E V02.20.126.11-41 版本之前，PXG3.W100-1 V02.20.126.11-37 版本之前，PXG3.W100-2 V02.20.126.11-41 版本之前，PXG3.W200-1 V02.20.126.11-37 版本之前，PXG3.W200-2 V02.20.126.11-41 版本之前。
solution:Upgrade siemens desigo_pxm30-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm30.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w100-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w100-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w200-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w200-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41)