Siemens Desigo Insight

Siemens Desigo Insight contains SQL injection (CWE-89) and cross-site scripting (CWE-1021) vulnerabilities in its web application interface that could allow an attacker to inject malicious code or retrieve sensitive data. The vulnerability requires user interaction—specifically, an authorized user must click a malicious link or visit a compromised website while accessing the Desigo Insight Web application. An attacker could exploit this to execute arbitrary SQL queries against the underlying database or run JavaScript in the context of the web application, potentially exposing configuration data, user credentials, or enabling unauthorized modification of building automation settings.