Softing Opc Toolbox vulnerabilities

2 CVEs affecting Softing Opc Toolbox, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-29661, published 2021-04-02.

More from Softing.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-29661, published 2021-04-02. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This…
• CVE-2021-29660, published 2021-04-02. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A Cross-Site Request Forgery (CSRF) vulnerability in en/cfg_setpwd.html in Softing AG OPC Toolbox through 4.10.1.13035 allows attackers to reset the administrative password by inducing the…