CVE-2020-15793CWE-1021

CVE-2020-15793: vulnerability in Siemens Desigo Insight

Published · Updated

Follow this CVE+ Monitor Desigo Insight

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
In short

Desigo Insight is vulnerable to clickjacking because it doesn't properly set security headers that prevent websites from being framed inside another site. An attacker could trick you into clicking on a fake website that loads the real application invisibly, stealing your actions and data.

Technical detail

The application fails to set the X-Frame-Options HTTP header, allowing attackers to embed it within an iframe on a malicious site. This enables clickjacking attacks where an unauthenticated attacker can deceive legitimate users into performing unintended actions or exposing sensitive data through UI redressing techniques.

Summary generated and translated by AI from the official description.
A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user to click on a website controlled by the attacker.
Affected products
Siemens · Desigo Insight
Related CVEs — Siemens Desigo Insight

In the same product, most dangerous first.

CVE-2020-15792—CVE-2020-15792EPSS 1.0%CVE-2020-15794—CVE-2020-15794EPSS 0.8%