CVE-2024-6558 Overview
CVE-2024-6558 is a stored cross-site scripting (XSS) vulnerability affecting HMS Industrial Networks Anybus-CompactCom 30 industrial communication modules. The flaw stems from missing input sanitization checks in web-accessible input fields. Attackers can inject HTML or JavaScript code that is persistently stored by the device. When an operator or engineer subsequently loads the affected page, the malicious payload executes in their browser context. This enables session-based social engineering attacks against personnel managing industrial network infrastructure. The vulnerability is tracked as CWE-79 and was disclosed through both HMS Networks and the CISA ICS advisory channel.
Critical Impact
Attackers with network access to the module web interface can inject persistent HTML/JavaScript payloads that execute in operator browsers, facilitating credential theft and social engineering against industrial control system personnel.
Affected Products
- HMS Networks Anybus-CompactCom 30 Module EtherNet/IP (hardware and firmware)
- HMS Networks Anybus-CompactCom 30 Module USB Without Housing (hardware and firmware)
- Related Anybus-CompactCom 30 industrial network communication modules
Discovery Timeline
- 2024-07-25 - CVE-2024-6558 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6558
Vulnerability Analysis
The Anybus-CompactCom 30 module exposes a web management interface used to configure industrial network communication parameters. The interface accepts user-supplied input through form fields but fails to sanitize or encode that input before storing it. Attackers can submit HTML tags and JavaScript payloads that the device persists across sessions. When a legitimate user loads the affected page, the browser parses and executes the stored payload in the context of the module's web origin. Because the modules are deployed in operational technology environments, exploitation can pivot from a network-accessible device to workstations used by control engineers.
Root Cause
The root cause is missing output encoding and input validation on user-controllable fields in the embedded web interface. The firmware writes attacker-supplied strings directly into HTML responses without escaping characters such as <, >, and ". This classifies as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation requires network reachability to the module's web interface and a subsequent visit by a victim user to the affected page. The attacker submits a payload into a vulnerable input field, and the payload is stored by the device. When an authenticated engineer or operator loads the page, the injected script runs in their browser and can perform actions such as reading page content, hijacking session state, or presenting fake authentication prompts. See the CISA ICS Advisory ICSA-24-193-20 and the HMS Security Advisory 2024-05-17 for technical details.
Detection Methods for CVE-2024-6558
Indicators of Compromise
- Unexpected <script>, <img onerror=>, or event-handler HTML strings stored in module configuration fields such as device name, description, or contact fields.
- Web responses from Anybus-CompactCom 30 management pages containing script content that was not authored by administrators.
- Browser telemetry showing script execution or outbound requests originating from the industrial module's web origin.
Detection Strategies
- Perform periodic configuration audits of Anybus-CompactCom 30 modules and compare stored field values against a known-good baseline.
- Inspect HTTP traffic to and from module IP addresses for POST requests containing HTML tags or JavaScript keywords in form parameters.
- Deploy endpoint monitoring on engineering workstations to identify anomalous script execution or credential prompts originating from OT network hosts.
Monitoring Recommendations
- Log and alert on any web-based configuration changes to Anybus-CompactCom 30 devices, especially outside authorized maintenance windows.
- Monitor OT network segments for unauthorized access attempts to industrial module management interfaces.
- Correlate engineering workstation browser activity with connections to OT device management URLs to identify potential victim interactions with malicious payloads.
How to Mitigate CVE-2024-6558
Immediate Actions Required
- Restrict network access to Anybus-CompactCom 30 module web interfaces using firewall rules or VLAN segmentation, permitting only trusted engineering workstations.
- Review all stored configuration fields on affected modules for injected HTML or script content and clear any suspicious values.
- Apply firmware updates from HMS Networks as referenced in the vendor advisory once available for the deployed module variant.
Patch Information
HMS Networks published mitigation guidance in the HMS Security Advisory 2024-05-17. Operators should consult the advisory for firmware versions and update procedures specific to their Anybus-CompactCom 30 module variant. CISA additionally provides defensive recommendations in ICSA-24-193-20.
Workarounds
- Isolate Anybus-CompactCom 30 modules on dedicated OT network segments that are not routable from business IT networks or the internet.
- Require VPN or jump-host access for any administrative connections to module web interfaces.
- Instruct engineering staff to access module configuration pages only from hardened workstations with up-to-date browsers and script-blocking controls.
- Disable or limit use of the web interface where the module can be managed through alternative protocols.
# Example: restrict access to Anybus module web interface using iptables on a gateway
iptables -A FORWARD -s 10.10.20.0/24 -d 192.168.100.50 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.100.50 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
