Siemens Web Server Login Page of Industrial Controllers
The login endpoint /FormLogin in affected web services does not apply proper origin checking.

This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack. CVE-2022-30694 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated. the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)