CVE-2017-12738 describes a Cross-Site Scripting (XSS) vulnerability in the integrated web server of Siemens SICAM RTUs SM-2556 COM Modules with specific firmware variants. An attacker could exploit this by tricking a user into clicking a malicious link, leading to potential client-side script execution. Rated Medium (CVSS 6.1), the vulnerability requires user interaction and network access but has low impact on confidentiality and integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
dnpi00CPE matchmatch criteria | cpe:2.3:o:siemens:sm-2556_firmware:dnpi00:*:*:*:*:*:*:* | ||
enos00CPE matchmatch criteria | cpe:2.3:o:siemens:sm-2556_firmware:enos00:*:*:*:*:*:*:* | ||
erac00CPE matchmatch criteria | cpe:2.3:o:siemens:sm-2556_firmware:erac00:*:*:*:*:*:*:* | ||
eta2CPE matchmatch criteria | cpe:2.3:o:siemens:sm-2556_firmware:eta2:*:*:*:*:*:*:* | ||
etls00CPE matchmatch criteria | cpe:2.3:o:siemens:sm-2556_firmware:etls00:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.