variot - var-201411-0418

VAR-201411-0418

Vulnerability from variot - Updated: 2023-12-18 12:07

Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. Nordex Control 2 is a fan control system. Nordex Control 2 (NC2) A cross-site scripting vulnerability exists in versions prior to SCADA 16. Because the program failed to properly filter the 'username' parameter, remote attackers exploited the vulnerability to build malicious URIs, enticing users to parse, get sensitive cookies, hijack sessions or Malicious operations on the client. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Nordex NC2 (also known as Nordex Control 2) is a set of SCADA (Data Acquisition and Supervisory Control) system used in the wind power industry by Nordex, Germany. Wind Farm Portal is a wind farm control portal based on this system

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201411-0418",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "control 2 scada",
        "scope": "lte",
        "trust": 1.8,
        "vendor": "nordex",
        "version": "15"
      },
      {
        "model": "se nordex control scada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nordex",
        "version": "216"
      },
      {
        "model": "control 2 scada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nordex",
        "version": "15"
      },
      {
        "model": "control scada",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nordex",
        "version": "216"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "nordex control 2 scada",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "BID",
        "id": "70851"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:nordex:nordex_control_2_scada:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "15",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Darius Freamon",
    "sources": [
      {
        "db": "BID",
        "id": "70851"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2014-5408",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2014-5408",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2014-08097",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "bb54805e-2351-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-73349",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-5408",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-08097",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201411-005",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "bb54805e-2351-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-73349",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. Nordex Control 2 is a fan control system. Nordex Control 2 (NC2) A cross-site scripting vulnerability exists in versions prior to SCADA 16. Because the program failed to properly filter the \u0027username\u0027 parameter, remote attackers exploited the vulnerability to build malicious URIs, enticing users to parse, get sensitive cookies, hijack sessions or Malicious operations on the client. \nAn attacker may leverage this issue to execute arbitrary script code  in the browser of an unsuspecting user in the context of the affected  site. This can allow the attacker to steal cookie-based authentication  credentials and launch other attacks. Nordex NC2 (also known as Nordex Control 2) is a set of SCADA (Data Acquisition and Supervisory Control) system used in the wind power industry by Nordex, Germany. Wind Farm Portal is a wind farm control portal based on this system",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "BID",
        "id": "70851"
      },
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-5408",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-303-01",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "70851",
        "trust": 2.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "BB54805E-2351-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "db": "BID",
        "id": "70851"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "id": "VAR-201411-0418",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      }
    ],
    "trust": 1.9
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:07:47.982000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "NORDEX CONTROL 2",
        "trust": 0.8,
        "url": "http://www.nordex-online.com/fileadmin/media/sonstiges/nordex_control_2_en.pdf"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-14-303-01"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/70851"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5408"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5408"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/70851/"
      },
      {
        "trust": 0.3,
        "url": "http://www.nordex-online.com/en/products-services/wind-turbines.html"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "db": "BID",
        "id": "70851"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "db": "BID",
        "id": "70851"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-11-06T00:00:00",
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-11-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "date": "2014-11-05T00:00:00",
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "date": "2014-10-30T00:00:00",
        "db": "BID",
        "id": "70851"
      },
      {
        "date": "2014-11-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "date": "2014-11-05T11:55:06.437000",
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "date": "2014-10-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-11-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      },
      {
        "date": "2015-08-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-73349"
      },
      {
        "date": "2014-10-30T00:00:00",
        "db": "BID",
        "id": "70851"
      },
      {
        "date": "2014-11-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-005257"
      },
      {
        "date": "2015-08-06T14:56:31.523000",
        "db": "NVD",
        "id": "CVE-2014-5408"
      },
      {
        "date": "2014-11-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Nordex NC2 \u0027username\u0027 Parameter Cross-Site Scripting Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "bb54805e-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-08097"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-005"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-5408 (GCVE-0-2014-5408)

Vulnerability from cvelistv5 – Published: 2014-11-05 11:00 – Updated: 2025-11-03 18:50

Title

Nordex NC2 Cross-site Scripting

Summary

Severity ?

No CVSS data available.

CWE

CWE-79

Assigner

icscert

References

URL

Tags

	https://www.cisa.gov/news-events/ics-advisories/i…
	http://www.securityfocus.com/bid/70851	vdb-entryx_refsource_BID
	https://github.com/cisagov/CSAF/blob/develop/csaf…

Impacted products

	Vendor	Product	Version
	Nordex	Nordex Control 2 (NC2) SCADA	Affected: 0 , ≤ 15 (custom)

Credits

Darius Freamon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:49.060Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-303-01"
          },
          {
            "name": "70851",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70851"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nordex Control 2 (NC2) SCADA",
          "vendor": "Nordex",
          "versions": [
            {
              "lessThanOrEqual": "15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Darius Freamon"
        }
      ],
      "datePublic": "2014-10-30T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.\u003c/p\u003e"
            }
          ],
          "value": "Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-03T18:50:14.150Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-303-01"
        },
        {
          "name": "70851",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70851"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-303-01.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNordex will release a patch for all affected NC2-SCADA versions until\n the end of 2014. The patching of the NC2-SCADA system has to be done by\n Nordex.\u003c/p\u003e\n\u003cp\u003eNordex will upgrade all wind farms with a valid service contract to \nthe patched version of the NC2-SCADA in coordination with normal \nmaintenance operations.\u003c/p\u003e\n\u003cp\u003eOwners of Nordex NC2-based wind farms without a valid service \ncontract can order the patch from Nordex by contacting their local \nNordex service organization.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Nordex will release a patch for all affected NC2-SCADA versions until\n the end of 2014. The patching of the NC2-SCADA system has to be done by\n Nordex.\n\n\nNordex will upgrade all wind farms with a valid service contract to \nthe patched version of the NC2-SCADA in coordination with normal \nmaintenance operations.\n\n\nOwners of Nordex NC2-based wind farms without a valid service \ncontract can order the patch from Nordex by contacting their local \nNordex service organization."
        }
      ],
      "source": {
        "advisory": "ICSA-14-303-01",
        "discovery": "EXTERNAL"
      },
      "title": "Nordex NC2 Cross-site Scripting",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-5408",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-14-303-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-303-01"
            },
            {
              "name": "70851",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70851"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-5408",
    "datePublished": "2014-11-05T11:00:00",
    "dateReserved": "2014-08-22T00:00:00",
    "dateUpdated": "2025-11-03T18:50:14.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201411-0418

CVE-2014-5408 (GCVE-0-2014-5408)

Tags

Sightings

Nomenclature