CVE-2022-3073: Quaonos Schema ST4 example templates prone to XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-14 · updated 2026-06-17
Weakness: CWE-79

Description

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.

Affected products

Weidmueller 19 Iot Md01 Lan H4 S0011 Firmware: all versions
Weidmueller Fp Iot Md01 4Eu S2 00000 Firmware: all versions
Weidmueller Fp Iot Md01 Lan S2 00000 Firmware: all versions
Weidmueller Fp Iot Md01 Lan S2 00011 Firmware: all versions
Weidmueller Fp Iot Md02 4Eu S3 00000 Firmware: all versions
Weidmueller Iot-Gw30-4G-Eu Firmware: through 1.16.0
Weidmueller Iot-Gw30 Firmware: through 1.16.0
Weidmueller Uc20-Wl2000-Ac Firmware: through 1.16.0
Weidmueller Uc20-Wl2000-Iot Firmware: through 1.16.0

References

Get alerted when CVE-2022-3073 or the next vulnerability affects your stack