CVE-2021-41541

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-08 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.

Affected products

Siemens Climatix Pol909 Firmware: before 11.36; before 11.44 — fixed in 11.36, 11.44

How to fix

Upgrade to a fixed version: Siemens Climatix Pol909 Firmware 11.36, 11.44. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41541 or the next vulnerability affects your stack