Energy management giant Schneider Electric has patched a cross-site scripting (XSS) vulnerability on one of its websites.
Elastica researcher Aditya Sood, who recently disclosed the existence of vulnerabilities in the Supervisory Control and Data Acquisition (SCADA) products of several major vendors, reported identifying a reflected XSS flaw on Schneider Electric’s e-order.biz website.
E-order.biz is a site where users can order products from Schneider Electric Motion USA, a Schneider Electric subsidiary that designs, manufactures and supplies motors, drives, and controls used in areas such as robotics, medical instruments, semiconductor manufacturing, laboratory automation, packaging, and biomedical.
Sood noted that an attacker could have also forced users to download malicious code onto their computers.
Schneider Electric patched the XSS vulnerability on e-order.biz within a few weeks after it was reported by Sood. The company told the researcher that it has taken this opportunity to bring third-party service providers up to speed on secure development practices.
While this particular issue affected one of Schneider Electric’s websites, the company’s industrial control system (ICS) products are also often found to be plagued by vulnerabilities. A report released in September by threat intelligence firm Recorded Future showed that roughly 20 flaws affecting Schneider ICS products have been disclosed annually since 2011.
The Recorded Future report shows that Schneider and Siemens are the companies with the highest number of vulnerabilities disclosed each year, which is not surprising given the popularity of their products.
Schneider Electric is one of the ICS vendors whose products were analyzed earlier this year by Sood. Since the vulnerabilities were previously reported by a different researcher, Schneider managed to develop a patch within a month after Sood disclosed his findings at the DEF CON conference in Las Vegas.