CVE-2015-4174: Siemens Climatix Bacnet/ip

Medium severity, CVSS 4.3. EPSS: 2.5% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected products

• Siemens Climatix Bacnet/ip: up to and including 10.33

Published 2015-06-28. Last modified 2026-06-17.