CVE:CVE-2022-40182
CNNVD:CNNVD-202210-502
Siemens Desigo PX是德国西门子（Siemens）公司的一套楼宇自动化控制系统。
Siemens 多款产品存在安全漏洞，该漏洞源于设备嵌入式基于 Chromium 的浏览器以 root 身份启动，并带有“--no-sandbox”选项。攻击者可以在“Operation” 图形中添加任意 JavaScript 代码，并成功利用任意数量的已知漏洞来攻击基于 Chromium 的嵌入式浏览器版本。Desigo PXM30-1 V02.20.126.11-41 版本之前，Desigo PXM30.E V02.20.126.11-41 版本之前，Desigo PXM40-1 V02.20.126.11-41 版本之前，Desigo PXM40.E V02.20.126.11-41 版本之前，Desigo PXM50-1 V02.20.126.11-41 版本之前，Desigo PXM50.E V02.20.126.11-41 版本之前，PXG3.W100-1 V02.20.126.11-37 版本之前，PXG3.W100-2 V02.20.126.11-41 版本之前，PXG3.W200-1 V02.20.126.11-37 版本之前，PXG3.W200-2 V02.20.126.11-41 版本之前。
solution:Upgrade siemens desigo_pxm30-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm30.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w100-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w100-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w200-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w200-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41)